Security of HOTP over an unencrypted channel for controling an actuator I have a simple on/off actuator that I want to control remotely. I want to use available hardware: a pair of microcontrollers connected to a pair of wireless transceiver modules.

Can HOTP algorithm be used over an unencrypted channel securely?
Can HOTP algorithm be used over an unencrypted channel securely?


Yes.

Essentially, HOTP is a stateful function that keeps an internal counter and then computes an HMAC over that counter followed by some truncations to get the right format. In the process the counter is also incremented.

So assuming we can model HMAC as a PRF then the output of each HOTP query is freshly random and unrelated because that's what a random function would do with distinct inputs (and that's how HMAC behaves because it's a PRF). This in particular means that an adversary cannot predict anything about future HMAC outputs or about past unseen outputs.

Of course the only guarantee you get from this is that an adversary cannot predict new authentication tokens and that new tokens likely won't be valid ever again. In particular HOTP by itself does not protect you from things like relay attacks or attacks where the adversary buffers a token and sends it later at a more convenient time.