OTP Scheme where only one party can generate the OTP, but both parties can verify it's validity
I'm looking for an OTP scheme between two parties where both parties can verify the validity of an OTP, but only one party can generate it.


The obvious way to do this is for one party (Alice) to select the one-time password and send the hash of that password to the other party (Bob).  Then, Bob can verify that Alice has the correct password (as Alice actually sends it), but Bob himself cannot generate it.

If Alice and Bob need to do this $n$ times based on the same exchanged key, then what Alice can do is select the base key, and hash that $n$ times, that is, compute $H^n(\text{base key}) = \underbrace {H(H(H(…H(\text{base key})))))}_{n \text{ times}}$, and send that to Bob.  Then, to authenticate the first time, she would send $H^{n-1}(\text{base key})$, which Bob can verify with his copy of the base key (but could not compute beforehand).  To authenticate the second time, she would send $H^{n-2}(\text{base key})$, and keep on doing this up to $n$ times.