Independent one-time passwords

Authors:
Aviel D. Rubin
Affiliations:
Bellcore, Morristown, NJ
Venue:
SSYM'95 Proceedings of the 5th conference on USENIX UNIX Security Symposium - Volume 5
Year:
1995

Citing 4
Cited 7

Differential cryptanalysis of the data encryption standard

Differential cryptanalysis of the data encryption standard
Linear cryptanalysis method for DES cipher

EUROCRYPT '93 Workshop on the theory and application of cryptographic techniques on Advances in cryptology
Password security: a case history

Communications of the ACM
Security problems in the TCP/IP protocol suite

ACM SIGCOMM Computer Communication Review

SPP: An anti-phishing single password protocol

Computer Networks: The International Journal of Computer and Telecommunications Networking
A pervasive identification service for physical access control

Proceedings of the 5th international conference on Pervasive services
Action-based user authentication

International Journal of Electronic Security and Digital Forensics
An efficient k-anonymous localization technique for assistive environments

Proceedings of the 2nd International Conference on PErvasive Technologies Related to Assistive Environments
Designing a context-aware system to detect dangerous situations in school routes for kids outdoor safety care

EUC'05 Proceedings of the 2005 international conference on Embedded and Ubiquitous Computing
GridOne: A complement to the GridOne authentication method

Network Security
Application Delivery: Application delivery: pros and cons both virtual and real

Network Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Existing one-time password (OTP) schemes suffer several drawbacks. Token-based systems are expensive, while software-based schemes rely on one-time passwords that are dependent on each other. There are disadvantages to authentication schemes that rely on dependent OTP's. It is difficult to replicate the authentication server without lowering security. Also, current authentication schemes based on dependent OTP's only authenticate the initial connection; the remainder of the session is assumed to be authenticated. Experience shows that connections can be hijacked. A new scheme for generating one-time passwords that are independent is presented. The independence property enables easy replication of the authentication server, and authentication that is persistent for the lifetime of a connection. This mechanism is also ideally suited for smart card applications. Our implementation and several applications are discussed.