OTP Scheme where only one party can generate the OTP, but both parties can verify it's validity As far as I understand, OTP usually works on a superficial layer by having two parties both know of a key and then authenticate each other by sharing a hash of the key and some sort of counter (e.g. currentTime mod someNumber) with each other. In theory, this means both parties can verify each other, as both have the capabilty to generate a OTP and both have the the capability to verify the integrity OTP given to them.

I'm looking for an OTP scheme between two parties where both parties can verify the validity of an OTP, but only one party can generate it. To my understanding, this would not work with the logic described above. Does such a protocol already exist? If not, is such a system even mathematically realizable?
I'm looking for an OTP scheme between two parties where both parties can verify the validity of an OTP, but only one party can generate it.


The obvious way to do this is for one party (Alice) to select the one-time password and send the hash of that password to the other party (Bob).  Then, Bob can verify that Alice has the correct password (as Alice actually sends it), but Bob himself cannot generate it.

If Alice and Bob need to do this $n$ times based on the same exchanged key, then what Alice can do is select the base key, and hash that $n$ times, that is, compute $H^n(\text{base key}) = \underbrace {H(H(H(…H(\text{base key})))))}_{n \text{ times}}$, and send that to Bob.  Then, to authenticate the first time, she would send $H^{n-1}(\text{base key})$, which Bob can verify with his copy of the base key (but could not compute beforehand).  To authenticate the second time, she would send $H^{n-2}(\text{base key})$, and keep on doing this up to $n$ times.