KEY(1)

NAME
S/key - A proceedure to use one time passwords for accessing computer systems.

DESCRIPTION
S/key is a proceedure for using one time password to authenticate access to compter systems. It uses 64 bits of information transformed by the MD4 algorithm. The user supplies the 64 bits in the form of 6 English words that are generated by a secure computer. Eg a pocket sized smart card or a PC/Macintosh, or a machine at work and printed on a sheet of paper. Example use of the S/key program key

  Usage example:

     >key 99 th91334

     Enter password: <your secret password is intered here>

     OMEN US HORN OMIT BACK AHOY

     >

The programs that are part of the S/Key system are keyinit, key, keyinfo, keysu, and keylogin. Keyinit is used to get your ID set up, key is used to get the onetime password each time, keyinfo is used to extract information from the S/Key database and the rest are system routines. For Lab 214 you must use keyinit on system latour and then telnet to system latour.bellcore.com (IP address 128.96.41.50) or if using dial-in you will routed to system cube for S/Key by the security system. Use keyinit -s ( for secure option) if you are doing the set up over insecure communications lines. These are telnet from outside Bellcore and MICOM dialin from off the Bellcore premises.

When you do "keyinit" you inform the system of your secret password. Running "key" then generates the one-time passwords, and also requires your secret password. If however, you misspell your password while running "key", you will get a list of passwords that will not work, and no indication about the problem.

Password reference numbers count backward from 99. If you don't know this, the syntax for "key" will be confusing.

When typing in your one-time password to gain access to latour, backspace (^H) can be used to make corrections. You can enter the passwords using small letters, even though the "key" program gives them in caps. When you run "key -n 10 `keyinfo` | lpr", and you do not find your printout at the printer, or in the bin of your login, or in the bin of your last name, or on the floor or any place else, you have a problem. Someone has accidentally or purposefully acquired a list of one-time passwords and your login (on the cover sheet) which give them access to your account. The only remedy is to run "keyinit" again but you do NOT have to change your secret password since the system will change the initial "key" for you. Now the missing information is useless.

It would be nice if the system had a way for you to advance (i.e. decrement) the counter in the database, so you could invalidate all the passwords you printed but this is not possible because of the algorithm.

Note the notion that one could remember a list of lists of 6 quasi-english words without writing them down is ridiculous. However, sending them to a printer without immediately retrieving the output is a big security hole.

Macintosh and a general purpose PC use are available. You may "download" them from the directory /usr/local/lib/key.

SEE ALSO
keyinit(1), keysu(1), keylogin(1), key(1), keyinfo(1)

AUTHOR
Command by Phil Karn, Neil M. Haller, John S. Walden

CONTACT
staff@thumper.bellcore.com