S/KEY is a one-time password system developed for authentication to Unix-like operating systems, especially from dumb terminals or untrusted public computers on which one does not want to type a long-term password. A user's real password is combined in an offline device with a short set of characters and a decrementing counter to form a single-use password. Because each password is only used once, they are useless to password sniffers. Because the short set of characters does not change until the counter reaches zero, it is possible to prepare a list of single-use passwords, in order, that can be carried by the user. Alternatively, the user can present the password, characters, and desired counter value to a local calculator to generate the appropriate one-time password that can then be transmitted over the network in the clear. The latter form is more common and practically amounts to challenge–response authentication. S/KEY is supported in Linux (via pluggable authentication modules), OpenBSD, NetBSD, and FreeBSD, and a generic open-source implementation can be used to enable its use on other systems. OpenSSH also implements S/KEY since version OpenSSH 1.2.2 was released on December 1, 1999. One common implementation is called OPIE. S/KEY is a trademark of Telcordia Technologies, formerly known as Bell Communications Research (Bellcore). S/KEY is also sometimes referred to as Lamport's scheme, after its author, Leslie Lamport. It was developed by Neil Haller, Phil Karn and John Walden at Bellcore in the late 1980s. With the expiration of the basic patents on public-key cryptography and the widespread use of laptop computers running SSH and other cryptographic protocols that can secure an entire session, not just the password, S/KEY is falling into disuse. Schemes that implement two-factor authentication, by comparison, are growing in use.
Password generation The server is the computer that will perform the authentication.
This step begins with a secret key W. This secret can either be provided by the user, or can be generated by a computer. Either way, if this secret is disclosed, then the security of S/KEY is compromised. A cryptographic hash function H is applied n times to W, thereby producing a hash chain of n one-time passwords. The passwords are the results of the application of the cryptographic hash function: H(W), H(H(W)), ..., Hn(W). The initial secret W is discarded. The user is provided with the n passwords, printed out in reverse order: Hn(W), Hn−1(W), ..., H(H(W)), H(W). The passwords H(W), H(H(W)), ..., Hn−1(W) are discarded from the server. Only the password Hn(W), the one at the top of the user's list, is stored on the server.
Authentication
After password generation, the user has a sheet of paper with n passwords on it. If n is very large, either storing all n passwords or calculate the given password from H(W) become inefficient. There are methods to efficiently calculate the passwords in the required order, using only ⌈ log n 2 ⌉ {\displaystyle \left\lceil {\frac {\log n}{2}}\right\rceil } hash calculations per step and storing ⌈ log n ⌉ {\displaystyle \lceil \log n\rceil } passwords. More ideally, though perhaps less commonly in practice, the user may carry a small, portable, secure, non-networked computing device capable of regenerating any needed password given the secret passphrase, the salt, and the number of iterations of the hash required, the latter two of which are conveniently provided by the server requesting authentication for login. In any case, the first password will be the same password that the server has stored. This first password will not be used for authentication (the user should scratch this password on the sheet of paper), the second one will be used instead:
The user provides the server with the second password pwd on the list and scratches that password. The server attempts to compute H(pwd), where pwd is the password supplied. If H(pwd) produces the password the server has stored, then the authentication is successful. The server will then store pwd as the current reference. For subsequent authentications, the user will provide passwordi. (The last password on the printed list, passwordn, is the first password generated by the server, H(W), where W is the initial secret). The server will compute H(passwordi) and will compare the result to passwordi−1, which is stored as reference on the server.
… excerpt ends here. Continue reading the full article.
