OTPWCalc

User Commands
OTPWCalc(1)
Name
OTPWCalc - Client application for calculating responses to OTP challenges.
Synopsis
OTPWCalc [-h] [-v] [-V]
Description
Playing the role of a hardware token in a client server authentication system as described in RFC 2289, OTPWCalc calculates responses to incoming authentication challenges as typed in by the user.
Options
-h Display a brief help message and exit.
-v Print verbose text to the calling terminal.
-V Print the version number and exit.
Terms
Username
The name that the server knows. For example, 'albertc'.
Secret
A password, usually selected by the user, that is needed to gain access to the server. For example, 'Mysec2-pw'.
Challenge
Information printed by the server when it tries to authenticate a user. This information is needed by OTPWCalc to generate a proper response. For example, 'otp-md5 820 dinw23612'.
Response
Information generated from a challenge that is used by the server to authenticate the user. For example, 'BIEM ROSE JINX HARD BALL SKY NEW'.
Seed
Information used in conjunction with the secret and sequence number to compute the response. It allows the same secret to be used for multiple sequences by changing the seed, or for authentication to multiple servers by using different seeds.
Sequence #
A counter used to track key iterations. Each time a successful response is received by the server the sequence number is decremented. For example, 71.
Hash ID
Text that identifies the cryptographical algorithm used. The valid hash identifiers are 'otpmd4' corresponding to MD4, and 'otp-md5' corresponding to MD5.
Files
The application may store a cookie in a file used to restore the most recent settings. The location of this file (or arbitrary data structure) varies according to the operating system.
Bugs
This manual.
Security
All of the authentication strategies covered in the standards implemented by this application are vulnerable to man in the middle (MITM) attacks. The strategies can be combined with public key logic to defeat such attacks.
Standards
The IETF standards RFC 1760 (The S/KEY One-Time Password System) and RFC 2289 (A One-Time Password System) are implemented.
See also
None. This is a self contained, stand alone application with no alias commands. It is unique in that it leverages open technologies like Javascript to run unmodified on a variety of operating systems.
Author
This application was written by Michael Schloh von Bennewitz.
Contact
Please refer to the OTPWCalc homepage for contact information.
Support
The OTPWCalc mailing list provides information and answers to questions. Commercial support is provided by the author.