The implementation of the HOTP (HMAC-based One-Time Password) algorithm on a SIM card allows for two-factor authentication that is platform-independent. This approach works across various mobile devices, from legacy handsets to modern smartphones, ensuring a consistent user experience.
The development process involves creating a Java Card applet that utilizes the UICC (Universal Integrated Circuit Card) framework. The applet registers itself within the STK (SIM Toolkit) menu, enabling users to trigger password generation directly through the phone interface.
During development, the author encountered technical limitations regarding persistent memory storage for HMAC keys on certain cards. To resolve this, the system initializes the HMAC key in volatile memory using a stored secret key buffer during each execution cycle.
The applet functions by requesting local date and time information from the terminal. It then processes this data—stripping seconds and time zone information—to generate a six-digit dynamic binary code in accordance with the RFC 4226 standard.
Testing the applet requires a specific hardware setup and the FunGP library. Configuration involves a JSON file that maps card identifiers, such as IMSI, to their respective keys and counters, facilitating the management of multiple test cards.
