2

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets)

To me that means I need a non-electronic list of passwords that are protected by a physical means such as a secure envelope, or silver coating.

  • What are my options as far as printing and distributing these OTPs to end users?

One of the first options that come to mind is to have a company like BABN/Oberthur Technolgies print this with a scratch off similar to how they print lottery tickets, however they are only interested in high volume distributions.

enter image description here

Based on my experience in the lottery ticket industry, there is a lot of technology that goes into the silver coating, and often there are several layers of ink and patterns laid on top of each other. And even with this, some ink layering techniques are better than others.

  • What "scratch off" technology is secure enough for an OTP password? What should I avoid?

As an alternative to the silver coating, perhaps a perforated envelope could be used. ADP is well known for their secure printing facilities (for checks) that make it difficult to impossible to view the contents of one of their tamper evident envelopes. Again, they aren't in the business of distributing OTP tokens to end users in small volumes.

  • Are there any in-house or outsourced opportunities available?
  • What other physical features should I look at w.r.t. a OTP password list (waterproof, etc)
Improve this question
4
  • 2
    Interesting. Can't you simply bake passwords into pastry?
    – Deer Hunter
    Feb 1, 2013 at 17:37
  • @DeerHunter - a cookie perhaps, folded around and over it?
    – AJ Henderson
    Feb 1, 2013 at 18:26
  • @AJHenderson - am afraid this would fall within the scope of Seasoned Advice SE... :p
    – Deer Hunter
    Feb 1, 2013 at 18:32
  • This is a bit tricky to do. The underlying fact of this whole situation is that while it is indeed possible to produce the silver/scratchie foil for OTP's it's not really secure. Searching on sites like AliBaba show up hundreds of suppliers offering services to do this. Custom foils, interweaved with holograms, with microcuts in them (to prevent peeling back the sticker) etc all exist. If you order a new credit card from your bank. They'll send the PIN out separate to the actual card, the pin will likely have some kind of similar protection on it to prevent fraud.
    – NULLZ
    Feb 2, 2013 at 0:04

2 Answers 2

Reset to default
1

Tamper-evident systems (like the scratching technology you evoke) are not exactly what you want for an OTP. What these technology offer is a way to make sure a posteriori that the information was not disclosed. If you see the card and it is still unscratched, then you know that the OTP is still "secure" and has not been used by anybody. The security benefit for an OTP situation is indirect at best: it means that the theft of an OTP will ultimately be discovered when the intended OTP user finds the card already scratched -- that is, if he finds the card. The attacker could simply purloin the card, scratch it, use the OTP, then throw the card in a river.

What you want for OTP is something which the users will find easy to keep secure (physically) until time of usage. Using credit-card sized devices is a good idea: the most secure storage system which is available to most users is their wallet. But there is not much to be gained by making them "scratchable".

For an OTP list, you want something where users can easily "tick off" uses passwords. This might be a "tear off"; after all, once used, an OTP is useless to everybody and can be disposed of without any care (except ecological). You could imagine a small stack of stick-up notes, each with its own OTP printed on it.

Improve this answer
3
  • The idea comes from the need of noticing and reporting OTP password theft. The scratch off technique prevents duplication from casual observation. Perhaps it would make sense if physically attached to a RIFD ID badge, etc.
    – makerofthings7
    Feb 1, 2013 at 18:13
  • There are packages which howl gently if opened; spray the unhappy opener with stinky ink; or notify central control through wireless means... Not cheap, I'd say.
    – Deer Hunter
    Feb 1, 2013 at 18:17
  • 1
    It depends what direction they are going. If the point is to ensure that information can be exchanged with a server without eavesdropping, then it would still work. The sender would know not to use it if it is scratched. It provides security, just not authentication.
    – AJ Henderson
    Feb 1, 2013 at 18:28
-1

What does "several" mean?

If you want to distribute several thousand OTP cards, the scratch thing might be a way to go.

How often will the users have to authenticate? Your scratch card will only be able to carry about 100 otp values.

If you only want to distribute a several dozens I would recommend OTP display card like these from smartdisplayer. I guess up to a badge of 100 users/cards, distributing display cards, from the size of a credit card with a display and a button would be the best and cheapest way to go. Any decent backend like privacyidea should be able to work with those cards. The cards can be deactivated in the backend, so that they can only be used, when the user confirms the receiving of the card.

In many countries banks were using TAN lists with a perforated envelope. But I never liked the low security of the banking area ;-)

Again - I think it very much depends on

  1. the amount of users you need to enroll and
  2. how long they are supposed to use OTP.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .