michael@4:

OTPWCalc

michael@4:

User Commands

michael@4:

OTPWCalc(1)

michael@4:

Name

michael@4:

OTPWCalc - Client application for calculating responses to OTP challenges.

michael@4:

Synopsis

michael@4:

OTPWCalc [-h] [-v] [-V]

michael@4:

Description

michael@4:

Playing the role of a hardware michael@4: token in a client server authentication system as described michael@4: in RFC 2289, OTPWCalc calculates responses to incoming michael@4: authentication challenges as typed in by the user.

michael@4:

Options

michael@4:

michael@4: -h Display a brief help message and exit.
michael@4: -v Print verbose text to the calling terminal.
michael@4: -V Print the version number and exit. michael@4:

michael@4:

Terms

michael@4:

Username

michael@4:

michael@4: The name that the server knows. For example, 'albertc'. michael@4:

michael@4:

Secret

michael@4:

michael@4: A password, usually selected by the user, that is michael@4: needed to gain access to the server. For example, michael@4: 'Mysec2-pw'. michael@4:

michael@4:

Challenge

michael@4:

michael@4: Information printed by the server when it tries to michael@4: authenticate a user. This information is needed by michael@4: OTPWCalc to generate a proper response. For example, michael@4: 'otp-md5 820 dinw23612'. michael@4:

michael@4:

Response

michael@4:

michael@4: Information generated from a challenge that is used michael@4: by the server to authenticate the user. For example, michael@4: 'BIEM ROSE JINX HARD BALL SKY NEW'. michael@4:

michael@4:

Seed

michael@4:

michael@4: Information used in conjunction with the secret and michael@4: sequence number to compute the response. It allows michael@4: the same secret to be used for multiple sequences michael@4: by changing the seed, or for authentication to michael@4: multiple servers by using different seeds. michael@4:

michael@4:

Sequence #

michael@4:

michael@4: A counter used to track key iterations. Each time michael@4: a successful response is received by the server the michael@4: sequence number is decremented. For example, 71. michael@4:

michael@4:

Hash ID

michael@4:

michael@4: Text that identifies the cryptographical algorithm michael@4: used. The valid hash identifiers are 'otpmd4' michael@4: corresponding to MD4, and 'otp-md5' corresponding michael@4: to MD5. michael@4:

michael@4:

Files

michael@4:

michael@4: The application may store a cookie in a file used to michael@4: restore the most recent settings. The location of this michael@4: file (or arbitrary data structure) varies according to michael@4: the operating system. michael@4:

michael@4:

Bugs

michael@4:

This manual.

michael@4:

Security

michael@4:

michael@4: All of the authentication strategies covered in the michael@4: standards implemented by this application are vulnerable michael@4: to man in the middle (MITM) attacks. The strategies can michael@4: be combined with public key logic to defeat such attacks. michael@4:

michael@4:

Standards

michael@4:

michael@4: The IETF standards RFC 1760 (The S/KEY One-Time Password michael@4: System) and RFC 2289 (A One-Time Password System) are michael@4: implemented. michael@4:

michael@4: