title: OTP S/KEY - How are Seeds generated, are they random each time?
body: <p>I'm looking at developing a One-time Password authentication system (j2me for phone, php for server side)</p>
  
  <p>I'm trying to get my head around the process, here is what i understand</p>
  
  <ol>
  <li>user > inputs random secret (S) into hash n number of times</li>
  <li>user > submits S^n to server</li>
  <li>server > saves n and S^n</li>
  <li>user > generates (S^n)-1 and submits to server</li>
  <li>server > takes user input and applies hashing function 1 more time and checks it against previously stored hash</li>
  </ol>
  
  <p>Now, from reading RFC2289 (S/Key) There is a seed that is issued to the client and concatenated with the user's secret when they input a unique identifier (at step 4) How is this seed created, is it random, is it stored.</p>