michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: OTPWCalc michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: michael@0: michael@0:
michael@0: michael@0: michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:
michael@0:

Help

michael@0: F. A. Q. michael@0: Quickstart michael@0: Manpage michael@0: Mailinglist michael@0: Security michael@0: Standards michael@0:
michael@0:
michael@0:
michael@0: michael@0:
michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:
michael@0:

What is a One Time Password?

michael@0:

A One Time Password (OTP) is a password valid only for a single use and, once used, cannot be used again for authentication. OTPs avoid a number of shortcomings that are associated with traditional (static) passwords.

michael@0:
michael@0:
michael@0:

What can I do with this app?

michael@0:

This application serves one purpose only. It calculates and prints a OTP.

michael@0:
michael@0:
michael@0:

What can I do with OTPs?

michael@0:

Most people use OTPs to log in to their website administration, CMS, or remote console.

michael@0:
michael@0:
michael@0:

Can I log into my Google account?

michael@0:

No. Google uses OTPs, but in a slightly nonstandard way. OTPWCalc cannot calculate OTPs useful for Google authentication yet.

michael@0:
michael@0:
michael@0:

Can I log in to Win/OSX/Oracle?

michael@0:

Yes, but some work is needed on the Windows/OSX/Oracle computer to configure the authentication subsystem.

michael@0:
michael@0:
michael@0:

Can I log in to Unix/Linux?

michael@0:

Yes, by using PAM and it's quite easy.

michael@0:
michael@0:
michael@0:

What else can I do with it?

michael@0:
    michael@0:
  1. Impress your friends
    2. michael@0:
  2. VPN authentication
    3. michael@0:
  3. Single sign on
    4. michael@0:
  4. Remote access
    5. michael@0:
  5. Computer login
    6. michael@0:
  6. Disk encryption
    7. michael@0:
  7. Internet services
    8. michael@0:
  8. Systems integration
    9. michael@0:
  9. CMS authentication
    10. michael@0:
  10. Password management
    11. michael@0:
  11. Email and money transfer
    12. michael@0:
  12. Bank transaction validation
    13. michael@0:
michael@0:
michael@0:
michael@0:

Can I install OTPWCalc on …?

michael@0:
    michael@0:
  • FirefoxOS: Yes
    • michael@0:
  • Sailfish: No
    • michael@0:
  • Android: No
    • michael@0:
  • Tizen: Yes
    • michael@0:
  • MeeGo: No
    • michael@0:
  • Bada: No
    • michael@0:
  • iOS: No
    • michael@0:
  • Unix: No
    • michael@0:
  • Linux: No
    • michael@0:
  • Mac OSX: No
    • michael@0:
  • BlackBerry QNX: No
    • michael@0:
  • Windows Phone: Yes
    • michael@0:
  • Windows Store: Yes
    • michael@0:
michael@0:
michael@0:
michael@0:

Why isn't OTPWCalc compatible?

michael@0:

OTPWCalc might not be compatible with your platform of choice, usually because the necessary hardware isn't available to the author for development.

michael@0:
michael@0:
michael@0:

What happens to my password?

michael@0:

Take a look at the entry point in michael@0: main.js:

michael@0: michael@0: var secr = $('#paswrd').val();
michael@0: var resp = hash(secr, user, iter); michael@0: michael@0:

In other words, the password you enter is neither stored nor transmitted. In fact, OTPWCalc doesn't store or transmit any data input at all (see James Bond question later.) It's a calculator in the true sense, just like a pocket calculator that adds numbers.

michael@0:
michael@0:
michael@0:

Is OTPWCalc safe and secure?

michael@0:

The algorithms of OTP have proven worthy of high security applications. OTPWCalc has been carefully designed and is tested thoroughly. It's both secure and safe to use.

michael@0:
michael@0:
michael@0:

Is it useful in a corporate setting?

michael@0:

Yes. Custom built enterprise versions are available accompanied with commercial support. Visit the OTPWCalc homepage for information.

michael@0:
michael@0:
michael@0:

Does James Bond use OTPWCalc?

michael@0:

Maybe, but spies probably just look over shoulders or use cameras to steal the static passwords used in OTP systems.

michael@0:
michael@0:
michael@0:

Same as Yubikey or RSA SecurID?

michael@0:

Yubikey, RSA SecurID, and OTPWCalc use similar technologies for similar applications, but OTPWCalc is strictly software and doesn't depend on the time or date.

michael@0:
michael@0:
michael@0:

How can I upgrade my OTPWCalc?

michael@0:

This varies according to the operating system used so there's no single answer.

michael@0:
michael@0:
michael@0:

Who owns OTPWCalc?

michael@0:

OTPWCalc is the property of the copyright holder, Michael Schloh von Bennewitz.

michael@0:
michael@0:
michael@0:

Is OTPWCalc licensed?

michael@0:

OTPWCalc is distributed under the terms of the European Union Public Licence. This liberal license grants you freedom to use the software and much more.

michael@0:
michael@0:
michael@0:

Which programming language?

michael@0:

OTPWCalc is built using the HTML, CSS, and JavaScript languages.

michael@0:

The jQuery Mobile and Apache Cordova development frameworks provide important additional features.

michael@0:
michael@0:
michael@0:

What are ongoing developments?

michael@0:

OTPWCalc is both active and stable, and follows a project management plan.

michael@0:
    michael@0:
  • It is undergoing nationalization to several european languages.
    • michael@0:
  • HMAC-based RFC 4226 (HOTP) is being implemented.
    • michael@0:
  • Features like QR and OpenID integration are being explored.
    • michael@0:
  • Most of all, OTPWCalc is being ported to new platforms.
    • michael@0:
michael@0:

To request features or pose questions please write to the mailing list.

michael@0:
michael@0:
michael@0:

How can I report a bogue (bug)?

michael@0:

Please write to the mailing list stating the OTPWCalc version and platform. Thanks for every bug report!

michael@0:
michael@0:
michael@0:

My question isn't answered,
or this is just not working!

michael@0:

Please turn to the mailing list and ask for help there. Answers appear in a day.

michael@0:
michael@0:
michael@0:
michael@0: michael@0:
michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:

michael@0: To start using OTPWCalc now… michael@0:

michael@0:
    michael@0:
  1. Install and configure a OTP authentication server on the host computer.
    2. michael@0:
  2. Add a username, seed ID, and password to the OTP authentication server.
    3. michael@0:
  3. Log in to the host computer providing the recently added username. The host computer will reply with a challange including the appropriate seed ID and a new counter number.
    4. michael@0:
  4. Type the seed ID and counter number along with the corresponding password into OTPWCalc. Click Submit.
    5. michael@0:
  5. Read the resulting OTP in
    red uppercase characters
    .
    6. michael@0:
  6. Type the OTP into the host computer console and…
    Enjoy secure access!
    7. michael@0:
michael@0:
michael@0:
michael@0: michael@0:
michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:
User Commands
michael@0:
OTPWCalc(1)
michael@0:
michael@0:
Name
michael@0:
OTPWCalc - Client application for calculating responses to OTP challenges.
michael@0:
Synopsis
michael@0:
OTPWCalc [-h] [-v] [-V]
michael@0:
Description
michael@0:
Playing the role of a hardware michael@0: token in a client server authentication system as described michael@0: in RFC 2289, OTPWCalc calculates responses to incoming michael@0: authentication challenges as typed in by the user.
michael@0:
Options
michael@0:
michael@0: -h Display a brief help message and exit.
michael@0: -v Print verbose text to the calling terminal.
michael@0: -V Print the version number and exit. michael@0:
michael@0:
Terms
michael@0:
Username
michael@0:
michael@0: The name that the server knows. For example, 'albertc'. michael@0:
michael@0:
Secret
michael@0:
michael@0: A password, usually selected by the user, that is michael@0: needed to gain access to the server. For example, michael@0: 'Mysec2-pw'. michael@0:
michael@0:
Challenge
michael@0:
michael@0: Information printed by the server when it tries to michael@0: authenticate a user. This information is needed by michael@0: OTPWCalc to generate a proper response. For example, michael@0: 'otp-md5 820 dinw23612'. michael@0:
michael@0:
Response
michael@0:
michael@0: Information generated from a challenge that is used michael@0: by the server to authenticate the user. For example, michael@0: 'BIEM ROSE JINX HARD BALL SKY NEW'. michael@0:
michael@0:
Seed
michael@0:
michael@0: Information used in conjunction with the secret and michael@0: sequence number to compute the response. It allows michael@0: the same secret to be used for multiple sequences michael@0: by changing the seed, or for authentication to michael@0: multiple servers by using different seeds. michael@0:
michael@0:
Sequence #
michael@0:
michael@0: A counter used to track key iterations. Each time michael@0: a successful response is received by the server the michael@0: sequence number is decremented. For example, 71. michael@0:
michael@0:
Hash ID
michael@0:
michael@0: Text that identifies the cryptographical algorithm michael@0: used. The valid hash identifiers are 'otpmd4' michael@0: corresponding to MD4, and 'otp-md5' corresponding michael@0: to MD5. michael@0:
michael@0:
Files
michael@0:
michael@0: The application may store a cookie in a file used to michael@0: restore the most recent settings. The location of this michael@0: file (or arbitrary data structure) varies according to michael@0: the operating system. michael@0:
michael@0:
Bugs
michael@0:
This manual.
michael@0:
Security
michael@0:
michael@0: All of the authentication strategies covered in the michael@0: standards implemented by this application are vulnerable michael@0: to man in the middle (MITM) attacks. The strategies can michael@0: be combined with public key logic to defeat such attacks. michael@0:
michael@0:
Standards
michael@0:
michael@0: The IETF standards RFC 1760 (The S/KEY One-Time Password michael@0: System) and RFC 2289 (A One-Time Password System) are michael@0: implemented. michael@0:
michael@0:
See also
michael@0:
michael@0: None. This is a self contained, stand alone application with michael@0: no alias commands. It is unique in that it leverages open michael@0: technologies like Javascript to run unmodified on a variety michael@0: of operating systems. michael@0:
michael@0:
Author
michael@0:
michael@0: This application was written by michael@0: Michael Schloh von Bennewitz. michael@0:
michael@0:
Contact
michael@0:
michael@0: Please refer to the michael@0: OTPWCalc homepage for contact information. michael@0:
michael@0:
Support
michael@0:
michael@0: The michael@0: OTPWCalc mailing list provides information and answers to michael@0: questions. Commercial support is provided by the michael@0: author. michael@0:
michael@0:
michael@0:
michael@0: michael@0:
michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:
michael@0:

Security

michael@0:

General security concerns should be directed to the mailing list, while those of a private nature should be sent directly to the author. X.509 certificates (for exchanging S/MIME encrypted email) and GnuPG keys (to verify released software signatures) reside on the author's website.

michael@0:

Please monitor the mailing list and keep your installation of OTPWCalc up to date!

michael@0:
michael@0:
michael@0:
michael@0: michael@0:
michael@0:
michael@0:

OTPWCalc

michael@0:
michael@0:
michael@0:
michael@0:

Standards

michael@0:

This application implements
the following standards:

michael@0: michael@0:
michael@0:
michael@0:
michael@0: michael@0: