Definition: one-time password (S/Key) . . . .: A password authentication enhancement, the one-time password allows you to log on only once with a password, after which that password is no longer valid. The way this works is that instead of having a normal password you would memorize, you are given a list of passwords. You use each password sequentially. You might use a hardware device that maintains the list for you.

Each time you login, you ask the hardware device for the next password. Key point: The true secret (such as the password used to encrypt the passwords) is never sent across the wire. A hacker could certainly sniff the password from the wire, but it is now useless. Example: The original OTP system was named "S/Key"; a term trademarked by Bellcore. The idea was to create a password authentication system that integrated seamlessly to existing UNIX systems. Other approaches require replacing existing protocols/software with secure password exchanges (like challenge-responses or public-key crypto). However, it should be noted that the S/Key protocol is still vulnerable to man-in-the-middle attacks.

.................................
Source: Hacking-Lexicon / Linux Dictionary V 0.16
http://www.tldp.org/LDP/Linux-Dictionary/html/index.html
Author: Binh Nguyen linuxfilesystem(at)yahoo(dot)com(dot)au
.................................

> Linux/Unix/Computing Glossary