You want your secret to have a secret? Several apps that provide time based one time password storage/management can also be secured with bio-metrics, pins or passwords (Aegis, MS Authenticator). Are you specifically thinking physical tokens only?
back
1 comments
If you need to conform with higher NIST assurance levels, a one time password generator needs to have a secret as well.
Commercial solutions support this with challenge/response tokens or PINs. I’d love to see an OSS solution.
Perhaps you could link to these NIST standards?