Re: OTP (One-Time Pad Generator Program) and MD5 signature

From: Alex Vinokur (alexvn_at_x-privat.org)
Date: 04/18/05 

Date: Mon, 18 Apr 2005 06:50:52 +0300

"Harald Hanche-Olsen" <hanche@math.ntnu.no> wrote in message news:pcozmvx3vip.fsf@shuttle.math.ntnu.no...
> + "Alex Vinokur" <alexvn@x-privat.org>:
>
> | OTP at http://www.fourmilab.ch/onetime/otpgen.html
>
> (I deleted a soft hyphen that had snuck into the URL.)
[snip]
>
> The way I read this, the MD5 signature has nothing to do with the
> encryption of message, but are only intended for one-time password
> applications. The idea is this: The program creates a sequence of
> passwords together with their MD5 hashes.

For instance,
1) Current session key and its MD5 signature: gtweuzpy 04AE0013DFAC7807A4846425AAE03D48
2) Next session key and its MD5 signature: choginzx 5C35E01460B99DCFD633C452DDA3D88F

> You keep the password, the
> computer keeps the hashes. Now, when you wish to log in, or use some
> password protected service on the computer, you pick the next password
> from the list and send it (in the clear) to the computer, which
> compares it with the next hash on its list.

The recipient picks key 'choginzx'.

> If they match, you're in.

The computer searchs 'choginzx' in the list and checks its MD5 signature.
Is MD5 signature used here?

> If not, tough luck. The computer is of course supposed to keep
> track so the same password won't work twice, hence keeping
> eavesdroppers from using the password.
[snip] 

-- 
 Alex Vinokur
     email: alex DOT vinokur AT gmail DOT com
     http://mathforum.org/library/view/10978.html
     http://sourceforge.net/users/alexvn

Relevant Pages