I use a hard token to login to a VPN but I don't get the concept behind it.The password is a combination of a self generated PIN + OTP generated on eToken Pass. How does authentication take place at the back end and what is the criterion for OTP expiration?
Log in to share your answer and help other learners.
Log in to answerBest Answer · By JanBask Cyber Security Expert
Answered on Feb 3, 2022
The eToken Pass has two modes to operate. Eventbased and Timebased. The basics for these are RFC4226 and RFC6238. BUT Safenet changed the event based tokens this way, that they do not use SHA1 anymore but SHA256, which is - strictly speaking - not HOTP compliant. The event based OTP values do not expire. You can press the button now and use the OTP value tomorrow. The time based OTP value is only valid within a time window, which is defined by the authentication backend.
The "IV" mentioned by @Iserni is a 20 byte (SHA1) or 32 byte (SHA256) symmetric key, which is unique to the token.OTP = truncate(HMAC-SHA1(Key + Counter)) The counter is either the event counter (key presses) or the unixtime/30. The server component knows the last counter and calculates an OTP value and compares the OTP value the user provided with the OTP value the server calculated. More in the RFCs.
Free tutorials and interview questions from industry experts — learn the skill, then get ready to prove it.
Step-by-step Cyber Security guides from industry experts
Common Cyber Security interview questions, answered
Guides, tips and career advice on Cyber Security from JanBask experts.
Cyber Security Ethical Hacker Roles and Responsibilities: What Do Ethical Hackers Actually Do?
What does an ethical hacker actually do? See the five-phase process, daily tasks, required skills, and where ethical hackers work.
Cyber Security Penetration Tester Roles and Responsibilities: What Does a Pen Tester Do?
Learn what a penetration tester does, including key roles, responsibilities, daily tasks, tools, skills, reporting, and…
Cyber Security GRC Analyst Roles and Responsibilities: What Does a GRC Analyst Do?
What does a GRC analyst actually do? See the core responsibilities, how they grow by experience level, a daily routine, tools,…
Cyber Security SOC Analyst Roles and Responsibilities: What Does a SOC Analyst Do?
What does a SOC analyst actually do? Explore core responsibilities, the Tier 1–3 structure, daily tasks, tools, and skills in…