- S/KEY
S/KEY is a
one-time password system developed forauthentication toUnix-like operating system s, especially fromdumb terminals or untrusted public computers on which one does not want to type a long-term password. A user's real password is combined in an offline device with a short set of characters and a decrementing counter to form a single-use password. Because each password is only used once, they are useless to password sniffers.Because the short set of characters does not change until the counter reaches zero, it is possible to prepare a list of single-use passwords, in order, that can be carried by the user. Alternatively, the user can present the password, characters and desired counter value to a local calculator to generate the appropriate one-time password that can then be transmitted over the network in the clear. The latter form is more common and practically amounts to
challenge-response authentication .S/KEY is supported in
Linux (viaPluggable authentication modules ),OpenBSD ,NetBSD , andFreeBSD , and a generic open source implementation can be used to enable its use on other systems. S/KEY is a trademark ofTelcordia Technologies , formerly known as Bell Communications Research (Bellcore).S/KEY is also sometimes referred to as Lamport's scheme, after its author. It was developed by Neil Haller,
Phil Karn and John Walden at Bellcore in the late 1980s. With the expiration of the basic patents onpublic key cryptography and the widespread use oflaptop computers runningSSH andother cryptographic protocols that can secure an entire session, not just the password, S/KEY is fallinginto disuse.SecurID is a related one-time password scheme that still sees widespread usebecause, unlike S/KEY, it providestwo-factor authentication by requiring a physical token that cannot be easily reproduced.Password generation
The "server" is the computer that will perform the authentication.
# This step begins with a secret key "w". This secret can either be provided by the user, or can be generated by a computer. Either way, if this secret is disclosed then the security of S/KEY is compromised
# "H" is acryptographic hash function
# "H" is applied "n" times to "w", thereby producing ahash chain of "n" one-time passwords (the passwords are the results of the cryptographic hash "H").
# The initial secret "w" is discarded
# The user is provided with the "n" passwords, printed out in reverse order.
# The last "n-1" passwords are discarded from the server. Only the first password, at the top of the user's list, is stored on the server.Authentication
After password generation, the user has a sheet of paper with "n" passwords on it. The first password is the same password that the server has stored. This first password will not be used for authentication (the user should scratch this password on the sheet of paper), the second one will be used instead:
* The user provides the server with the second password on the list and scratches that password
* The server attempts to compute "H(pwd)" where "pwd" is the password supplied. If "H(pwd)" produces the first password (the one the server has stored), then the authentication is successful. The server will then store "pwd" as the current reference.For subsequent authentications, the user will provide password "i". (The last password on the printed list, password n, is the first password generated by the server, "H(w)", where "w" is the initial secret).The server will compute "H(password i)" and will compare the result to password "i-1", which is stored as reference on the server.
ecurity
The security of S/KEY relies on the difficulty of reversing
cryptographic hash functions . Assume an attacker manages to get hold of a password that was used for a successful authentication. Supposing this is password "i", this password is already useless for subsequent authentications, because each password can only be used once. It would be interesting for the attacker to find out password "i-1", because this password is the one that will be used for the next authentication.However this would require inverting the hash function that produced password "i" using password "i-1" ("password i = H(password i-1)"), which is extremely difficult to do with current
cryptographic hash functions .S/KEY is however vulnerable to a
man in the middle attack if used by itself. It is also vulnerable to certainrace condition s, such as where an attacker's software sniffs the network to learn the first N-1 characters in the password (where N equals the password length), establishes its own TCP session to the server, and in rapid succession tries all valid characters in the Nth position until one succeeds. These types of vulnerabilities can be avoided by using ssh, SSL, SPKM or other encrypted transport layer.Usability
Internally, S/KEY uses 64 bit numbers. For human
usability purposes, each number is mapped to 6 short words of 1 to 4 characters each from a publicly accessible 2048-word dictionary. For example, one 64 bit number maps to "ROY HURT SKI FAIL GRIM KNEE."References
* [http://citeseer.ist.psu.edu/cache/papers/cs/5967/ftp:zSzzSzftp.mcc.ac.ukzSzpubzSzsecurityzSzPAPERSzSzPASSWORDzSzSKEY.pdf/haller94skey.pdf 'THE S/KEY(TM) ONE-TIME PASSWORD SYSTEM' by Neil M. Haller]
* [http://www.cacr.math.uwaterloo.ca/hac/ The handbook of applied cryptography, Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone] Chapter 10 describes Lamport's scheme on page 396
* RFC 1760 - The S/KEY One-Time Password System
* RFC 2289 - A One-Time Password SystemExternal links
* [http://www.ocf.berkeley.edu/~jjlin/jsotp/ jsotp: JavaScript OTP & S/Key Calculator]
* [http://www.orange-carb.org/SkeyCalc/documentation.html#about Introduction to the system]
* [http://tanso.net/j2me-otp Java Micro Edition S/key calculator for cell phones]
Wikimedia Foundation. 2010.