First of all, I should mention that I read this thread and it was useful in my case, but I need more comments and reviews about this authentication method.
USB Token authentication which I want to talk is :
1- User logon to server with
2- server requests for some USB credentials like serial number, expiration date, etc
3- User fills the requested parameters and send them to server
4- Server generates an login token and signs it with its
5- User downloads the token and save it in encrypted USB Flash memory.
Now every time that user wants to login to server, server asks for username, password and token. User uploads the token from his USB to the server. Server verifies the signature with its
public key and if it is verified, the user can log in.
From security point I know that the USB flash memory is not as secure as PKI smart tokens. Because the token is exportable and it has no
TPM standard, however I am wondering what other security issues this mechanism has?