Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets)

To me that means I need a non-electronic list of passwords that are protected by a physical means such as a secure envelope, or silver coating.

  • What are my options as far as printing and distributing these OTPs to end users?

One of the first options that come to mind is to have a company like BABN/Oberthur Technolgies print this with a scratch off similar to how they print lottery tickets, however they are only interested in high volume distributions.

enter image description here

Based on my experience in the lottery ticket industry, there is a lot of technology that goes into the silver coating, and often there are several layers of ink and patterns laid on top of each other. And even with this, some ink layering techniques are better than others.

  • What "scratch off" technology is secure enough for an OTP password? What should I avoid?

As an alternative to the silver coating, perhaps a perforated envelope could be used. ADP is well known for their secure printing facilities (for checks) that make it difficult to impossible to view the contents of one of their tamper evident envelopes. Again, they aren't in the business of distributing OTP tokens to end users in small volumes.

  • Are there any in-house or outsourced opportunities available?
  • What other physical features should I look at w.r.t. a OTP password list (waterproof, etc)
share|improve this question
2  
Interesting. Can't you simply bake passwords into pastry? –  Deer Hunter Feb 1 '13 at 17:37
    
@DeerHunter - a cookie perhaps, folded around and over it? –  AJ Henderson Feb 1 '13 at 18:26
    
@AJHenderson - am afraid this would fall within the scope of Seasoned Advice SE... :p –  Deer Hunter Feb 1 '13 at 18:32
    
This is a bit tricky to do. The underlying fact of this whole situation is that while it is indeed possible to produce the silver/scratchie foil for OTP's it's not really secure. Searching on sites like AliBaba show up hundreds of suppliers offering services to do this. Custom foils, interweaved with holograms, with microcuts in them (to prevent peeling back the sticker) etc all exist. If you order a new credit card from your bank. They'll send the PIN out separate to the actual card, the pin will likely have some kind of similar protection on it to prevent fraud. –  NULLZ Feb 2 '13 at 0:04
add comment

1 Answer

Tamper-evident systems (like the scratching technology you evoke) are not exactly what you want for an OTP. What these technology offer is a way to make sure a posteriori that the information was not disclosed. If you see the card and it is still unscratched, then you know that the OTP is still "secure" and has not been used by anybody. The security benefit for an OTP situation is indirect at best: it means that the theft of an OTP will ultimately be discovered when the intended OTP user finds the card already scratched -- that is, if he finds the card. The attacker could simply purloin the card, scratch it, use the OTP, then throw the card in a river.

What you want for OTP is something which the users will find easy to keep secure (physically) until time of usage. Using credit-card sized devices is a good idea: the most secure storage system which is available to most users is their wallet. But there is not much to be gained by making them "scratchable".

For an OTP list, you want something where users can easily "tick off" uses passwords. This might be a "tear off"; after all, once used, an OTP is useless to everybody and can be disposed of without any care (except ecological). You could imagine a small stack of stick-up notes, each with its own OTP printed on it.

share|improve this answer
    
The idea comes from the need of noticing and reporting OTP password theft. The scratch off technique prevents duplication from casual observation. Perhaps it would make sense if physically attached to a RIFD ID badge, etc. –  makerofthings7 Feb 1 '13 at 18:13
    
There are packages which howl gently if opened; spray the unhappy opener with stinky ink; or notify central control through wireless means... Not cheap, I'd say. –  Deer Hunter Feb 1 '13 at 18:17
1  
It depends what direction they are going. If the point is to ensure that information can be exchanged with a server without eavesdropping, then it would still work. The sender would know not to use it if it is scratched. It provides security, just not authentication. –  AJ Henderson Feb 1 '13 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.