[3249] in cryptography@c2.net mail archive
RE: Time Based Token?
daemon@ATHENA.MIT.EDU (tzeruch@ceddec.com)
Tue Aug 25 17:15:43 1998
Date: Tue, 25 Aug 1998 17:07:40 -0400
From: tzeruch@ceddec.com
To: Jacob Langseth <jlangseth@esisys.com>
cc: "'cryptography@c2.net'" <cryptography@c2.net>
In-Reply-To: <01BDD03F.23ACDBD0.jlangseth@esisys.com>
On Tue, 25 Aug 1998, Jacob Langseth wrote:
> Client is authenticated by the server through verification
> of credentials which consist of an SHA1 hash of a shared
> secret and a timestamp.
Yes, minimally.
> The client sends the hash over the wire, the server generates
> its own copy of the credentials, verifies that it matches the
> client's, and authenticates accordingly.
No, the setup would start with a shared secret being programmed in to both
the client and server. This would never be sent over the wire. The
timestamp would simply alter the hash to provide unique passwords every
minute.
> Unfortunately, this doesn't provide any protection from someone
> on the local system immediately replaying the credentials. I
I could prevent the reuse of credentials, but it still leaves a
man-in-the-middle attack.
> An augmentation which might work a little better would be to
> have the host send a challenge to the client, which is then
I already thought of that (and have a DES version) - but these don't use
the time. Some variant of S/Key might also work. Since I have a clock in
the Palm III, I was wondering if there was a way to use it for
authentication.
