Unable to read HOTP counter error

Nitrokeys
1

I installed Ubuntu 24.04 on NovaCustom NV41 laptop with Dasharo + Heads. I also have Nitrokey 3A.

So I performed TPM reownership and then generated new TOTP/HOTP secrets. I got the QR code for Google Authenticator.

However when I reboot the computer, there is an error:
“can’t open ‘/boot/kexec_hotp_counter’: No such file or directory”, and then I can also see “Unable to read HOTP counter”.

I checked /boot partition and yes, there is no /boot/kexec_hotp_counter file there.

Anyway, few lines later (in Dasharo console, when booting), there is another error: “Error occured, status code 33: HOTP slot is not configured”.

Dasharo in GUI menu writes: “HOTP: Error checking code, Insert HOTP USB Security Dongle a” (then the text is cut).

However, computer boots normally, and if I try to tamper the /boot partition (by adding a random empty file), it detects tampering.

How to get rid of this error (and what does it mean anyway)?

2

Hello, can you try to update your Heads firmware with the latest one that you can find here:

and try again the factory reset process.

3

OK, I did that (installed Dasharo (coreboot+heads) 2.5.0), and also updated my Nitrokey to 1.8.0 with nitropy, but is still the same.

I also performed factory reset (TPM reownership).

4

OK, it seems I did the mistake not to performed factory reset WHILE reflashing. Now I did that, and everything is working.

Well… except for one small thing. Now I have Nitrokey logo instead of Dasharo logo. :confused:

Also, I have another question. There was a QR code which I added it to Authenticator. How can I verify the integrity with QR code (and not Nitrokey)? For instance, if I do not have Nitrokey with me or something…

5

Here is explained what you can do with the TPMTOTP:

6

Sorry, but I am unable to find this TPM PCR code.

IMG_20241218_152952_446
IMG_20241218_152952_4462236×2816 1.08 MB

I only see that HOTP code is correct, but can not see the verification code.

7

Sorry, here is the image. IMG-20241218-152952-446 hosted at ImgBB — ImgBB

8

edit: What you show in the image is a boot screen.
The QR code is just displayed for you to import the TOTP secret into an authenticator app conveniently.
Subsequently, the 6-digit TOTP is displayed in the main heads menu on each boot (right at the top, next to HOTP), so you can compare it to the authenticator app output prior to selecting a boot entry.