1

I've recently stumbled across the Gemalto IDPrime MD series of smartcards which offer PKI and OTP functionality (I know the difference in key management / generation and user oriented usage).

Now I searched a bit around and found no satisfying answer to the question:

  • Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?
  • If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password usually move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?

As a side note: I do not include OTP tokens made specifically for large companies, because obviously they'd be manufactured with a company-known secret / customized from the company.

As a side note: If the token has a display (like a RSA SecurID), the user can simply read the OTP and enter it manually using the keyboard and if it features a direct USB connection (like a YubiKey) the token can just emulate a keyboard and type it by itself.

  • This is a development question rather than a security question. I've voted to migrate to SO. – Polynomial May 4 '16 at 20:58
  • 2
    @Polynomial I disagree; this is about the typical usage / functionality / administration of hardware OTP tokens - it is not about how to program them. SO won't know what to do with this. Good question SEJPM. – Mike Ounsworth May 5 '16 at 3:35
  • I've only used these in their PKI mode, not in OTP mode, but in our application they interface with the Windows crypto layer CAPI via a USB card reader. – Mike Ounsworth May 5 '16 at 3:41
1

You may be interested in reading:

Both of them describe standard ways of creating a One-Time Password.

Do all (standard) hardware OTP tokens require the developer to pass the OTP to the manufacturer's server for verification?

There are two options here: * The OTP token is specific to your application, either you manufacture your own hardware token, flash with your own secret a token made by others or bought the token to a manufacturer (which would provide you a file with the secret keys for your token(s)), in which case no communication with the manufacturer is needed during operation.

However, if the manufacturer provides the OTP token as a service for multiple entities (like YubiCloud), then yes, the application would need to ask every time to the manufacturer server if the given OTP token is valid.

Suppose you had a way to verify tokens without a central registry, perhaps because the token has an embedded signature you can check with a public key associated to the device). Then, when you attempt to login into website A, it could copy your token and impersonate you with it in website B.

(U2F is designed to avoid this problem by including a challenge, but it is no longer a simple OTP token)

If an OTP token (e.g. a smartcard), does not feature a USB connection nor a display, how does the one time password move to the user? Via direct API access? Via a new window? Via an non-PC connected card reader?

The smartcard would usually be moved to the user through a USB card reader, although any device bringing the gap -such as the card reader with an independent screen you suggest- would actually work.

  • Yes is not true! The manufacturer - an ordinary token manufacturer - will give you the hardware OTP token and a seed file containing the secret keys. Of course a service provider will not give you the secret and require you to use his service. But he was asking for manufacturers and not service providers. – cornelinux May 4 '16 at 21:38
  • @cornelinux Good point. I was thinking about a service. I have edited the answer to include this. – Ángel May 4 '16 at 22:23
1

As stated in your other post:

No. You do not need to pass the OTP value to the manufacturers site. Usually - if you are buying pure OATH/HOTP tokens cheap in china (like Feitian), you will not even be able to do this. You need to run your own server like privacyIDEA.

The smartcard is usually no OTP token. However, some smartcards like from Gemalto indeed have an OTP application on it. In this case you need to insert the smartcard into a smartcard reader and you need to have an additional application on your client. This application will communicate with the smartcard to retrieve the OTP value.

  • so the user just gets provided with an OTP secret and puts that one onto his card / device (after some sort of [physical] authentication)? sounds reasonable. – SEJPM May 4 '16 at 21:17
  • The enrollment very much depends on the OTP device. Yes. Usually a "registration officer" should be included. Or a shipping via post and assuming that only this user is able to open his pyhsical letter box... – cornelinux May 4 '16 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.