C300 Display Token [HOTP/TOTP/OCRA]

The FEITIAN C300 is a keypad display token that generates OATH event-based (HOTP) and time-based (TOTP) one-time passwords and also supports OATH challenge-response (OCRA) and transaction signature. It is aimed at banks and other organizations that need to confirm transactions as well as logins, with a built-in LCD, numeric keypad and multiple-level PIN protection.

DOWNLOAD DATA SHEET HERE

The OTP c300 hardware token provides OATH event/time-based and challenge response one-time-password. The OTP c300 effectively eliminates many threats by secure your accounts with a second factor authentication.

Interested in bulk orders? Reach out to our team at sales@ftsafe.us for volume discounts.

Key Features:

• Built-in LCD and numeric keypad
• OATH event/time-based OTP
• OATH challenge response (OCRA)
• OATH transaction signature
• Multiple-level PIN protection seed alteration

Seed Delivery

By default, FEITIAN will deliver OTP Seed/secret files to the contact email address on the order, shortly after we ship the order. If a different email is required or a different encoding format, please add a specific note to the order.

Seed Encoding Format

The default format we will provide is for HOTP tokens/cards - Hexadecimal; and for TOTP tokens/cards - Base32

We support multiple encoding formats, but most commonly:

Delivery mechanics

We will send two emails, one containing the encrypted seed files, another the password to decrypt.

Warranty: This product comes with a 1-year warranty from the date of purchase. 

To customize this product, please contact us. 

Compatibility and Use Cases

The C300 supports HOTP, TOTP and OCRA, so it fits authentication servers that use any of these OATH methods. Seeds come in Hex for HOTP and Base32 for TOTP, with WatchGuard RFC 6030 XML also available (see the seed table above). Confirm that your authentication server supports challenge-response before you deploy it. Typical uses:

• Transaction confirmation and signing in banking
• Login MFA where one token must cover both HOTP and TOTP systems
• Logins that call for a token with PIN protection

Compare models in our OTP tokens collection, or read our guide to hardware OTP tokens vs software authenticators.

Frequently Asked Questions

What is challenge-response (OCRA)?

The server shows a number, you key it into the C300, and the token answers with a code tied to that challenge. Banks use this pattern to confirm transactions.

How is the C300 different from the C200 or C100?

The C200 is a time-based (TOTP) keychain token and the C100 is event-based (HOTP), both without a keypad. The C300 adds a numeric keypad, supports both HOTP and TOTP, and adds challenge-response and transaction signature. For simple login codes, the C200 or C100 is the simpler choice.

Is the C300 PIN protected?

Yes. FEITIAN lists multiple-level PIN protection among the C300's key features.

How are the C300 seed files delivered?

FEITIAN emails the encrypted seed files to the contact address on the order shortly after shipping, and sends the decryption password in a second email. The default format is Hexadecimal for HOTP and Base32 for TOTP; WatchGuard RFC 6030 XML with an AES 128 key is also available. If you need a different email address or format, add a note to your order.

Is the C300 phishing resistant?

No. Like any one-time password device, a person reads the code and types it, so a fake login page can relay it in real time. For accounts that attackers target directly, use FIDO2 security keys, and keep OTP tokens for VPNs, legacy apps and phone-free users.