TOTP and HOTP (RFC 6238 and 4226)

1. HOTP algorithm

   HMAC-based one-time password with dynamic truncation.

2. HOTP security considerations

   Counter synchronization and brute-force limits.

3. TOTP algorithm

   Time-step derived counter, T0 and X parameters.

4. TOTP validation and resynchronization

   Validation window and clock drift handling.

5. TOTP security considerations

   Shared secret handling and replay.

6. Key URI format (otpauth)

   otpauth:// URI used for QR code provisioning.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.