One-Time Password Authentication System - Summary

This group is not part of the GNU Project.

Intro

A one-time password (OTP) is a password that is only valid for a single login session or transaction (usually along a normal static password). Using them reduces risks associated with login into your system from unsecure (keylogged) workstations.

For detailed information please visit a homepage.

Implementation

The program is written in C (C99) and implements OTP as described in
"Perfect Paper Passwords v3". OTPasswd also kind of extends this idea with "salt". Program shares all main ideas with ppp-pam project. It tries to extend it and fix it's deficiencies.

OTPasswd is in development. In ChangeLog there's a list of things I'd like to implement before publishing this as a version 1.0.  Most of features work (as of v0.7) but of course - it requires tests. Think of this as a beta software. I myself use it on my production servers with Out-of-band passcode messaging without problems for a year currently.

Features of 0.4v

• Passcard output in plain ASCII or in LaTeX
• Secure locking of state files to resolve race conditions.
• Many user definable options:
  • two alphabets to choose (of 64 or 88 characters)
  • (not)skipping on failures
  • (not)showing entered passcodes
  • selectable passcode length (from 2 to 16)
• Many admin definable options
  • enforcing passcode skipping
  • enforcing otpasswd usage
  • enforcing passcode (not)show setting
  • enabling passcode retry on failure
• May warn user during login if he's running out of passcodes.
• Written with respect for security.
• Compatible with Perfect Paper Passwords version 3 if salting is disabled during key creation.
• Salt support (see README for details). Makes pretty impossible known-plain-text attacks on the AES cypher even more impossible (as plain-text is no longer known for the attacker) and increases total key length from 256 to 352 bits which makes impossible brute-force attacks even more impossible.

• SMS/Mail/pigeon notification of current passcode.

Some of features added in 0.5v

• Two modes of operations with either state kept in user homes, or in /etc/otpasswd/otshadow (global database).
• Versatile system-wide policy when using global database.

• README/INSTALL rewritten/cleanup.
• LOTS of new documentation written thanks to Hannes Beinert (including manual pages)

• Global configuration file.
• User interface revised and cleaned up.
• Failure counting / warning.
• Out-of-band messaging can be secured with password.
• Custom alphabet support.
• Prepared for localization.
• Tested on FreeBSD
• Dropped dependency on OpenSSL

Changes of 0.7v

In this version we've totally dropped any external dependencies (GMP)
except for PAM. Also the utility is split into two executables, user interface called utility located in 'otpasswd' executable and agent which executes all operations on behalf of otpasswd.

This change is of security concern exclusively. It makes DoS attacks on state lock impossible for user and increases security in general (SUID part of code for example never uses gettext which makes use of environment which might be mangled by user).

There was also a BUG in static passwords implementation. It's now fixed, but you will have to regenerate your spasses on update. Except for this change state files are completely compatible.

Registration Date: Tue 01 Dec 2009 01:15:23 PM UTC
License: GNU General Public License v3 or later
Development Status: 4 - Beta