Internet Info 1994 March/Internet Info CD-ROM (Walnut Creek) (March 1994).iso/security/doc/clippings/930208-01

Internet Message Format | 1993-05-21 | 7.4 KB

Date: Mon, 8 Feb 93 16:07:41 EST
From: [e-mail] (Michael Platoff)
Message-Id: <[e-mail]>
To: [e-mail]
Subject: Dynamic password cards


Many people have contacted me about the results of my query for
vendors who sell dynamic password cards.  I've attached the most
informative message I received about these devices. There were
some other replies about software-only solutions, but I'm looking
for a device that a user can carry around with them to use from a
terminal or arbitrary node on the Internet.

Michael Platoff               email: [e-mail]
Siemens Corporate Research    phone: [phone]
755 College Road East
Princeton, NJ 08540-6668

------- Start of forwarded message -------
X-VM-Attributes: [nil nil nil nil nil]
Status: RO
Return-Path: <[e-mail]>
Received: from siemens.siemens.com by yogi.siemens.com (4.1/SMI-4.1)
    id AA09080; Fri, 5 Feb 93 16:35:38 EST
Received: from teal.csn.org by siemens.siemens.com with smtp
    (Smail3.1.28.1 #11) id m0nKaiG-00197rC; Fri, 5 Feb 93 16:35 EST
Received: by teal.csn.org id AA02925
  (5.65c/IDA-1.4.4 for [e-mail]); Fri, 5 Feb 1993 14:34:08 -0700
Message-Id: <[e-mail]>
From: Nathan Estey <[e-mail]>
To: [e-mail]
Subject: Re:  Dynamic password cards
Date: Fri, 5 Feb 1993 14:34:08 -0700

>From csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!malgudi.oar.net!caen!spool.mu.edu!news.nd.edu!mentor.cc.purdue.edu!noose.ecn.purdue.edu!samsung!transfer!ellisun.sw.stratus.com!cme Tue Oct  6 19:02:00 MDT 1992
Article: 5962 of sci.crypt
Path: csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!malgudi.oar.net!caen!spool.mu.edu!news.nd.edu!mentor.cc.purdue.edu!noose.ecn.purdue.edu!samsung!transfer!ellisun.sw.stratus.com!cme
From: [e-mail] (Carl Ellison)
Newsgroups: sci.crypt
Subject: RESULTS: challenge login devices
Message-ID: <[e-mail]>
Date: 6 Oct 92 16:26:17 GMT
Sender: [e-mail]
Organization: Stratus Computer, Software Engineering
Lines: 126

A while back, I wrote:

>I have heard descriptions of small devices (eg., pocket calculator size)
>which apply a secret DES key to a challenge (random) number to produce a
>response for use in login (instead of a password).  Does anyone out there
>know manufacturers for such devices so that I can get technical and
>price information?

Thanks to everyone who responded.

I have learned that the manufacturers all call these devices "tokens" or
"password tokens".

The following manufacturers have been brought to my attention:

    Company                Product Name(s)
    -------                ---------------

    Racal-Guardata            WatchWord
    480 Spring Park Place
    Herndon, VA 22070
    [phone]

    Enigma Logic, Inc.        SafeWord (4 versions):
    2151 Salvio #301        Gold Card, Silver Card,
    Concord, CA 94520        AccessCard, MultiSync
    [phone]

    Digital Pathways, Inc.        SecureNet
    201 Ravendale Drive
    Mountain View, CA 94043
    [phone]

    Hughes LAN Systems        ??? (they didn't seem to
    Hughes Aircraft Company        know what I was talking
    1225 Charleston Road        about when I called them)
    Mountain View, CA 94043
    [phone]

    Security Dynamics,        SecureID
    2067 Massachusetts Avenue,
    Cambridge, MA 02140
    [phone]

>From what I've been able to learn so far:

=====

Racal-Guardata makes a full line of H/W -- modems, key management boxes,
... -- and supports not just the WatchWord but also smartcards.  For
example, they have a product which is a modem into which you plug your
smartcard, enter a PIN (using keys and an LCD on the modem itself) and from
then on, you are not only authenticated but your line is continuously
encrypted.

WatchWord is used by the NCSC's dockmaster system and at least one user out
there thinks it's the best of the lot.  I was impressed with their
provision for multiple (2) keys and PINs -- the use of the PIN directly to
the token (never transmitted).  The WatchWord costs about $90 (quantity 1)
- -- but is a 4 function calculator as well, with memory (yup -- probably a
$5 value :-).

WatchWord operates by being challenged with a 7 digit (decimal) number (in
phone number format).  You enter your PIN and that number, then the
calculator gives you a 7-digit response which you type in response to the
login.  It's about 4.125" x 2.25" x 0.375".

====

Enigma Logic makes S/W to do the login authentication using almost all the
other tokens, not just their own.  The impression I got was that they
really wanted to sell S/W -- and sold H/W just because it was necessary.

SafeWord DES Gold: synchronous -- you enter your PIN and a host number, it
gives you the next password in your sequence.  There's no challenge -- you
have to keep in sync.  [as one person pointed out, you have to make sure
there's no kid in the house to fiddle with it and start generating
passwords you don't use.]  There are up to 8 different hosts provided for.

SafeWord DES Silver: synchronous -- press "on" and get the next password.
(no PIN, no multiple hosts)

SafeWord AccessCard: public key (allegedly), 7-digit challenge and
response.  Details on the algorithm aren't given in the data sheet I
received from them, so I don't know anything about their algorithm or how
they do key negotiation -- and I especially don't know how secure it is.
The brief sketch of how to initialize it doesn't say anything about having
to type hundreds of digits to and from the host to do key management -- so
it doesn't sound like DH exponential key exchange.

SafeWord MultiSync: up to four hosts, any of 4 modes: async (chal/resp);
1-button synchronous; PIN-async (PIN and challenge); PIN-sync (PIN => next
password).

All of these cards are bulky credit card size (3.4" x 2.2" x 0.2")

=====

SecureNet: two modes: async (chal/resp); sync (enter PIN and digit
selecting 1 of 6 hosts -- get next password in sequence).  Size: 52 x 89 x
9.8 mm (info from Enigma Logic data sheet).

Price about $60, (quantity 2).

=====

SecureID: time-synchronous: displays a new password continuously, changed
every minute or so.  The host keeps not only your key (for generating the
same sequence) but a synchronized clock.  My detailed info from them is
about to arrive.  This info is from sci.crypt readers.

SecureID does not use DES but rather a proprietary PRNG algorithm which was
reviewed and blessed by Ron Rivest.  This card is used by Cray users
worldwide (or so it seems from the responses I got).  It is credit-card
sized and if I remember correctly, in the $60 range (but that's not a real
price quote -- just (possibly flaky) memory).

=====

[e-mail] sent mail describing some S/W solution their company
sells, but that's not what I was asking for so I didn't follow up.

=====


- --Carl


>From csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!darwin.sura.net!haven.umd.edu!uunet!dove!csrc.ncsl.nist.gov!clancy Tue Oct  6 19:02:31 MDT 1992
Article: 5966 of sci.crypt
Path: csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!darwin.sura.net!haven.umd.edu!uunet!dove!csrc.ncsl.nist.gov!clancy
From: [e-mail] (Kim Clancy)
Newsgroups: sci.crypt
Subject: Re: RESULTS: challenge login devices
Message-ID: <[e-mail]>
Date: 6 Oct 92 18:38:09 GMT
References: <[e-mail]>
Sender: [e-mail]
Organization: National Institute of Standards & Technology
Lines: 4




I use Enigma Logics Multisycn card.  NIST sent it to me since I dial into


------- End of forwarded message -------