Security issues for integrating AAA and OTP services What are the main security issues for integrating AAA and OTP services. In our organization with about 1000 clients, we want to integrate the services. What are the main security issues about the protocols used? In fact, we must choose between a number of suggested proposals.
Usually OTP needs to send the password in clear text to your AAA server.
As the otp value is concatenated with a static password, the AAA server, which verifies the credentials, need to split the password.

E.g.: Your secret password is "secret" and your OTP generator creates "987432". Then you need to enter "secret987432".

As the client component does not know, how long the OTP value is and how long the fixed password is, the client needs to send the complete string.

It can not send a hash of this, since, the AAA server does not know, if the user entered "secret987432", which is the CURRENT valid OTP value or "secret897832", which would be the next OTP value, which - according to RFC4226 - can also be used for authentication.

So to avoid the stealing of the fixed password during authentication, you need to check if the authentication protocol is properly encrypted.