In a counter-based OTP system, what is the role of the secret key?

• A. It is used to decrypt the OTP provided by the user
• B. It is used to encrypt the generated OTP so the server can verify it matches
• C. It is shared publicly
• D. It is used to hash the password

Answer: (B)

The secret key acts as the shared input for generating the one-time password using a keyed-hash function (like HMAC) with the current counter value. The device computes the OTP by applying the hash to the secret key and the moving factor, then the server, which also knows that secret key, recomputes the same OTP for the current counter and compares it to what the user provided. If they match, authentication succeeds. The key isn’t decrypted or publicly shared, and the OTP isn’t “encrypted”—it’s a deterministic output derived from the secret key and the counter, used for verification.