I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this number must be made secret or the multi-factor benefit is broken.

I also noticed that some of my users are using a YubiKey, an RSA Key, and a Gemalto key for Banking, VPN service, and Amazon web services respectively.

I would like to offer multi-factor authentication, but want to avoid physical token bloat for the end user. (Them carrying too many tokens)


What information would I need to reuse an existing YubiKey, RSA, or Gemalto (or any other) in my own system?

I suppose the user will need to give me the serial number (so I can derive the key material) and I will need to determine the crypto algorithm for each key.

1 Answer 1


You probably don't want to go about doing it that way, as that could seriously compromise the keys of these things. With the information you would then have, your user's bank account is now more at risk because an attacker just needs to break your system, instead of the bank or a hardened security token.

Your biggest problem is likely going to be the fact that for tokens using event-based HOTP or related protocols, you have to keep the expected values in sync across systems you don't necessarily have any control over. Otherwise you run the risk of locking the user out of their bank.

Also, normally you need more than the serial number. There are seeds or IV's that are used to initially start the sequence, and are designed to not be read from the token.

  • 1
    the system holding information need at least the same level of security as the information it hold.
    – happy
    Commented Jan 1, 2013 at 0:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .