Date: Mon, 8 Feb 93 16:07:41 EST From: map@yogi.siemens.com (Michael Platoff) Message-Id: <9302082107.AA10812@yogi.siemens.com> To: firewalls@greatcircle.com Subject: Dynamic password cards Many people have contacted me about the results of my query for vendors who sell dynamic password cards. I've attached the most informative message I received about these devices. There were some other replies about software-only solutions, but I'm looking for a device that a user can carry around with them to use from a terminal or arbitrary node on the Internet. Michael Platoff email: map@scr.siemens.com Siemens Corporate Research phone: (609) 734-3354 755 College Road East Princeton, NJ 08540-6668 ------- Start of forwarded message ------- X-VM-Attributes: [nil nil nil nil nil] Status: RO Return-Path: Received: from siemens.siemens.com by yogi.siemens.com (4.1/SMI-4.1) id AA09080; Fri, 5 Feb 93 16:35:38 EST Received: from teal.csn.org by siemens.siemens.com with smtp (Smail3.1.28.1 #11) id m0nKaiG-00197rC; Fri, 5 Feb 93 16:35 EST Received: by teal.csn.org id AA02925 (5.65c/IDA-1.4.4 for map@yogi.siemens.com); Fri, 5 Feb 1993 14:34:08 -0700 Message-Id: <199302052134.AA02925@teal.csn.org> From: Nathan Estey To: map@yogi.siemens.com Subject: Re: Dynamic password cards Date: Fri, 5 Feb 1993 14:34:08 -0700 >From csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!malgudi.oar.net!caen!spool.mu.edu!news.nd.edu!mentor.cc.purdue.edu!noose.ecn.purdue.edu!samsung!transfer!ellisun.sw.stratus.com!cme Tue Oct 6 19:02:00 MDT 1992 Article: 5962 of sci.crypt Path: csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!malgudi.oar.net!caen!spool.mu.edu!news.nd.edu!mentor.cc.purdue.edu!noose.ecn.purdue.edu!samsung!transfer!ellisun.sw.stratus.com!cme From: cme@ellisun.sw.stratus.com (Carl Ellison) Newsgroups: sci.crypt Subject: RESULTS: challenge login devices Message-ID: <7015@transfer.stratus.com> Date: 6 Oct 92 16:26:17 GMT Sender: usenet@transfer.stratus.com Organization: Stratus Computer, Software Engineering Lines: 126 A while back, I wrote: >I have heard descriptions of small devices (eg., pocket calculator size) >which apply a secret DES key to a challenge (random) number to produce a >response for use in login (instead of a password). Does anyone out there >know manufacturers for such devices so that I can get technical and >price information? Thanks to everyone who responded. I have learned that the manufacturers all call these devices "tokens" or "password tokens". The following manufacturers have been brought to my attention: Company Product Name(s) ------- --------------- Racal-Guardata WatchWord 480 Spring Park Place Herndon, VA 22070 (703) 471-0892 Enigma Logic, Inc. SafeWord (4 versions): 2151 Salvio #301 Gold Card, Silver Card, Concord, CA 94520 AccessCard, MultiSync (510) 827-5707 Digital Pathways, Inc. SecureNet 201 Ravendale Drive Mountain View, CA 94043 (415) 964-0707 Hughes LAN Systems ??? (they didn't seem to Hughes Aircraft Company know what I was talking 1225 Charleston Road about when I called them) Mountain View, CA 94043 (415) 966-7400 Security Dynamics, SecureID 2067 Massachusetts Avenue, Cambridge, MA 02140 (617) 547-7820 >From what I've been able to learn so far: ===== Racal-Guardata makes a full line of H/W -- modems, key management boxes, ... -- and supports not just the WatchWord but also smartcards. For example, they have a product which is a modem into which you plug your smartcard, enter a PIN (using keys and an LCD on the modem itself) and from then on, you are not only authenticated but your line is continuously encrypted. WatchWord is used by the NCSC's dockmaster system and at least one user out there thinks it's the best of the lot. I was impressed with their provision for multiple (2) keys and PINs -- the use of the PIN directly to the token (never transmitted). The WatchWord costs about $90 (quantity 1) - -- but is a 4 function calculator as well, with memory (yup -- probably a $5 value :-). WatchWord operates by being challenged with a 7 digit (decimal) number (in phone number format). You enter your PIN and that number, then the calculator gives you a 7-digit response which you type in response to the login. It's about 4.125" x 2.25" x 0.375". ==== Enigma Logic makes S/W to do the login authentication using almost all the other tokens, not just their own. The impression I got was that they really wanted to sell S/W -- and sold H/W just because it was necessary. SafeWord DES Gold: synchronous -- you enter your PIN and a host number, it gives you the next password in your sequence. There's no challenge -- you have to keep in sync. [as one person pointed out, you have to make sure there's no kid in the house to fiddle with it and start generating passwords you don't use.] There are up to 8 different hosts provided for. SafeWord DES Silver: synchronous -- press "on" and get the next password. (no PIN, no multiple hosts) SafeWord AccessCard: public key (allegedly), 7-digit challenge and response. Details on the algorithm aren't given in the data sheet I received from them, so I don't know anything about their algorithm or how they do key negotiation -- and I especially don't know how secure it is. The brief sketch of how to initialize it doesn't say anything about having to type hundreds of digits to and from the host to do key management -- so it doesn't sound like DH exponential key exchange. SafeWord MultiSync: up to four hosts, any of 4 modes: async (chal/resp); 1-button synchronous; PIN-async (PIN and challenge); PIN-sync (PIN => next password). All of these cards are bulky credit card size (3.4" x 2.2" x 0.2") ===== SecureNet: two modes: async (chal/resp); sync (enter PIN and digit selecting 1 of 6 hosts -- get next password in sequence). Size: 52 x 89 x 9.8 mm (info from Enigma Logic data sheet). Price about $60, (quantity 2). ===== SecureID: time-synchronous: displays a new password continuously, changed every minute or so. The host keeps not only your key (for generating the same sequence) but a synchronized clock. My detailed info from them is about to arrive. This info is from sci.crypt readers. SecureID does not use DES but rather a proprietary PRNG algorithm which was reviewed and blessed by Ron Rivest. This card is used by Cray users worldwide (or so it seems from the responses I got). It is credit-card sized and if I remember correctly, in the $60 range (but that's not a real price quote -- just (possibly flaky) memory). ===== stachour@sctc.com sent mail describing some S/W solution their company sells, but that's not what I was asking for so I didn't follow up. ===== - --Carl >From csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!darwin.sura.net!haven.umd.edu!uunet!dove!csrc.ncsl.nist.gov!clancy Tue Oct 6 19:02:31 MDT 1992 Article: 5966 of sci.crypt Path: csn!magnus.acs.ohio-state.edu!zaphod.mps.ohio-state.edu!darwin.sura.net!haven.umd.edu!uunet!dove!csrc.ncsl.nist.gov!clancy From: clancy@csrc.ncsl.nist.gov (Kim Clancy) Newsgroups: sci.crypt Subject: Re: RESULTS: challenge login devices Message-ID: <5975@dove.nist.gov> Date: 6 Oct 92 18:38:09 GMT References: <7015@transfer.stratus.com> Sender: news@dove.nist.gov Organization: National Institute of Standards & Technology Lines: 4 I use Enigma Logics Multisycn card. NIST sent it to me since I dial into ------- End of forwarded message -------