+
+
OTPWCalc
+
+
+
User Commands
+
OTPWCalc(1)
+
+
Name
+
OTPWCalc - Client application for calculating responses to OTP challenges.
+
Synopsis
+
OTPWCalc [-h] [-v] [-V]
+
Description
+
Playing the role of a hardware
+ token in a client server authentication system as described
+ in RFC 2289, OTPWCalc calculates responses to incoming
+ authentication challenges as typed in by the user.
+
Options
+
+ -h Display a brief help message and exit.
+ -v Print verbose text to the calling terminal.
+ -V Print the version number and exit.
+
+
Terms
+
Username
+
+ The name that the server knows. For example, 'albertc'.
+
+
Secret
+
+ A password, usually selected by the user, that is
+ needed to gain access to the server. For example,
+ 'Mysec2-pw'.
+
+
Challenge
+
+ Information printed by the server when it tries to
+ authenticate a user. This information is needed by
+ OTPWCalc to generate a proper response. For example,
+ 'otp-md5 820 dinw23612'.
+
+
Response
+
+ Information generated from a challenge that is used
+ by the server to authenticate the user. For example,
+ 'BIEM ROSE JINX HARD BALL SKY NEW'.
+
+
Seed
+
+ Information used in conjunction with the secret and
+ sequence number to compute the response. It allows
+ the same secret to be used for multiple sequences
+ by changing the seed, or for authentication to
+ multiple servers by using different seeds.
+
+
Sequence #
+
+ A counter used to track key iterations. Each time
+ a successful response is received by the server the
+ sequence number is decremented. For example, 71.
+
+
Hash ID
+
+ Text that identifies the cryptographical algorithm
+ used. The valid hash identifiers are 'otpmd4'
+ corresponding to MD4, and 'otp-md5' corresponding
+ to MD5.
+
+
Files
+
+ The application may store a cookie in a file used to
+ restore the most recent settings. The location of this
+ file (or arbitrary data structure) varies according to
+ the operating system.
+
+
Bugs
+
This manual.
+
Security
+
+ All of the authentication strategies covered in the
+ standards implemented by this application are vulnerable
+ to man in the middle (MITM) attacks. The strategies can
+ be combined with public key logic to defeat such attacks.
+
+
Standards
+
+ The IETF standards RFC 1760 (The S/KEY One-Time Password
+ System) and RFC 2289 (A One-Time Password System) are
+ implemented.
+
+
See also
+
+ None. This is a self contained, stand alone application with
+ no alias commands. It is unique in that it leverages open
+ technologies like Javascript to run unmodified on a variety
+ of operating systems.
+
+
Author
+
+
Contact
+
+
Support
+
+
+