Subject: [426] RE: [423] S/Key for wu-ftpd 2.4

From: "The best things in life ... are fantasy." <[email-masked]>
Date: Thu, 08 Sep 1994 10:46:10 -0400 (EDT)

What is S/Key and what is it supposed to do?

Thanks.

PCVS

---

From: Howard Chu <[email-masked]>
Date: Thu, 08 Sep 1994 11:13:53 -0700

S/Key is a one-time password system; it was created to address the problem of
password snooping on the Internet. By insuring that a different password is
required every time you log in, you pretty much defeat the purpose of snooping.
S/Key uses a "secure hashing" algorithm which is supposed to be non-reversible.
(It runs MD4 on a password you choose, and runs the MD4 algorithm a number of
times in succession. All that ever crosses the network is the result of N runs
thru the algorithm. Each successive login, the N-1th result is used.) The
secret password never goes across the network, only the result of the secure
hash. [While MD4 hasn't actually been "cracked," it seems that it's not totally
secure, and probably MD5 should be used instead. There is an MD5 version of
S/Key available, but it doesn't seem to be as widely supported....]
  -- Howard