www.CSUA.Berkeley.EDU/skey-howto.html
S/Key is a one-time password scheme based on a one-way hash function (in our version, this is MD4 for compatibility; S/Key is a registered trademark of Bell Communications Research, Inc. There are three different sorts of passwords which we will talk about in the discussion below. The first is your usual UNIX-style or Kerberos password; The second sort is the one-time password which is generated by the S/Key key program and accepted by the keyinit program and the login prompt; The final sort of password is the secret password which you give to the key program (and sometimes the keyinit program) which it uses to generate one-time passwords; The secret password does not necessarily have anything to do with your UNIX password (while they can be the same, this is not recommended). While UNIX passwords are limited to eight characters in length, your S/Key secret password can be as long as you like; In general, the S/Key system operates completely independently of the UNIX password system. There are in addition two other sorts of data involved in the S/Key system; The login and su programs keep track of the last one-time password used, and the user is authenticated if the hash of the user-provided password is equal to the previous password. Because a one-way hash function is used, it is not possible to generate future one-time passwords having overheard one which was successfully used; The key program accepts an iteration count, a seed, and a secret password, and generates a one-time password. The keyinit program is used to initialized S/Key, and to change passwords, iteration counts, or seeds; The keyinfo program examines the /etc/skeykeys file and prints out the invoking user's current iteration count and seed. Finally, the login and su programs contain the necessary logic to accept S/Key one-time passwords for authentication. The login program is also capable of disallowing the use of UNIX passwords on connections coming from specified addresses. There are four different sorts of operations we will cover. The first is using the keyinit program over a secure connection to set up S/Key for the first time, or to change your password or seed. The second operation is using the keyinit program over an insecure connection, in conjunction with the key program over a secure connection, to do the same. The third is using the key program to log in over an insecure connection. The fourth is using the key program to generate a number of keys which can be written down or printed out to carry with you when going to some location without secure connections to anywhere (like at a conference). If you are using telnet or rlogin exit with no password and use keyinit -s. Enter secret password: ) I typed my pass phrase here Again secret password: ) I typed it again ID wollman s/key is 99 ha73896 ) discussed below SAG HAS FONT GOUT FATE BOOM ) There is a lot of information here. At theEnter secret password: prompt, you should enter some password or phrase (I use phrases of minimum seven words) which will be needed to generate login keys. The line starting ID' gives the parameters of your particular S/Key instance: your login name, the iteration count, and seed. When logging in with S/Key, the system will remember these parameters and present them back to you so you do not have to remember them. The last line gives the particular one-time password which corresponds to those parameters and your secret password; Insecure connection initialization To initialize S/Key or change your password or seed over an insecure connection, you will need to already have a secure connection to some place where you can run the key program; You will also need to make up an iteration count (100 is probably a good value), and you may make up your own seed or use a randomly-generated one. Over on the insecure connection (to the machine you are initializing), use the keyinit -s command: % keyinit -s Updating wollman: Old key: kh94741 Reminder you need the 6 English words from the skey command. Enter sequence count from 1 to 9999: 100 ) I typed this Enter new key default kh94742 : s/key 100 kh94742 To accept the default seed (which the keyinit program confusingly calls a key), press return. Then move over to your secure connection or S/Key desk accessory, and give it the same parameters: % key 100 kh94742 Reminder - Do not use this program while logged in via telnet or rlogin. Enter secret password: ) I typed my secret password HULL NAY YANG TREE TOUT VETO Now switch back over to the insecure connection, and copy the one-time password generated by key over to the keyinit program: s/key access password: HULL NAY YANG TREE TOUT VETO ID wollman s/key is 100 kh94742 HULL NAY YANG TREE TOUT VETO The rest of the description from the previous section applies here as well. You will also find a useful feature (not shown here): if you press return at the password prompt, the login program will turn echo on, so you can see what you are typing. This can be extremely useful if you are attempting to type in an S/Key by hand, such as from a printout. If this machine were configured to disallow UNIX passwords over a connection from my machine, the prompt would have also included the annotation (s/key required), indicating that only S/Key one-time passwords will be accepted. Generating a single one-time password Now, to generate the one-time password needed to answer this login prompt, we use a trusted machine and the key program. Thus: % key 92 hi52030 ) pasted from previous section Reminder - Do not use this program while logged in via telnet or rlogin. This is the easiest mechanism if you have a trusted machine.
|
http://csua.com/feed/