HOTP/TOTP docs unclear to end users

### Background info from currently existing documentation on TOTP/HOTP/TPMTOTP HOTP/TOTP documentation is segmented, and documented here (TPMTOTP/TOTP/HOTP keywords search in searchable docs): - https://osresearch.net/Prerequisites#usb-security-dongles-aka-security-token-aka-smartcard - https://osresearch.net/Keys/#tpmtotp-shared-secret - https://osresearch.net/Heads-threat-model/ - https://osresearch.net/FAQ/#hotp-vs-totp Confusion, this time, is around the fact that TOTP/HOTP are USB Security dongles supported features, and end users right to be confused into why XYZ other Security dongles cannot be used with Heads (which requires OpenGPG compatible smartcard for /boot digest signing with user owned and protected private key, and optionally a USB Security dongle supporting reverse HOTP supported by Nitrokey's bundled hotp_verification backend under Heads from https://github.com/Nitrokey/nitrokey-hotp-verification) ---- ### Current raised issue This leads to users asking question on matrix channel like [today](https://matrix.to/#/!DuZPJBBoKAZyvrWmpv:matrix.org/$5dM6mmrIZA0-mRoK-V9x-ikvHwgN_54d47bzZHufPoM?via=matrix.org&via=nitro.chat&via=tchncs.de): >> Hello all. I have a NovaCustom V56 and I am considering upgrading to Heads. >> >> I want to make sure I have a compatible USB security key before starting the process. The one I have, Solo 2, does not support TOTP and HOTP, so I'll need to buy a new one. I am considering a Yubikey, but I am puzzled because https://osresearch.net/Prerequisites#usb-security-dongles-aka-security-token-aka-smartcard says that Yubikey 5 Series does not support HOTP, whereas Yubico's website says it does. Can anyone confirm or refute that it's a mistake in the osresearch doc, and that I can proceed with getting a 5 Series and have full functionality supported with Heads? I answered there (clearly not enough, since TOTP/HOTP question comes often, showing https://github.com/linuxboot/heads-wiki/ docs, rendered at https://osresearch.net is not clear enough and/or still too technical for layman end users: > > NovaCustom V56 > > novacustom boards under Heads do not have non-hotp counterpart (as other boards), therefore only hotp boards are built. Reverse HOTP compliant dongles can be bought from original seller. Buying Dasharo+Heads should come with USB Security dongle here since those dongles are needed for Heads to function on those devices, and sold by Nitrokey/Novacustom. > > > Solo 2, does not support TOTP and HOTP > > TOTP has nothing to do with USB Security dongles. TPMTOTP is a secret derived from measurements (measured boot) of components in TPM PCRs, which is then used to generate TOTP codes on both phone and Heads screens, and those TOTP codes generated every 30 seconds matching if system clocks are in sync (GMT/UTC timezone system clock synced automatically or manually to a remote source, ie time.is/UTC). > > HOTP here means reverse HOTP challenged TPMTOTP shared secret with a counter, incremented inside of Heads. Indeed, most USB Security dongle will say they support TOTP and HOTP, but unfortunately this is langage issue, and will see what I can do to update the docs here to reduce confusion. osresearch.net is right stating that only Librem Key and Nitrokey dongles (as specified) are supported and known to work with Heads. > > TLDR: only Librem Key (equivalent of Nitrokey Pro v2), Nitrokey Pro v1/v2/v3 and Nitrokey Storage v1/v2 are known to be compatible with Heads (USB Security dongle's firmware + Heads https://github.com/Nitrokey/nitrokey-hotp-verification components need to be compatible with Heads to support reverse HOTP as needed).