Re: Cryptanalysis of SecurID (ACE/Server)

Perry E. Metzger (perry@piermont.com)
Mon, 28 Sep 1998 22:14:36 -0400

• Next message: Mok-Kong Shen: "Re: Some General Questions on Cryptography"
• Previous message: vinnie@vmeng.com: "Re: Cryptanalysis of SecurID (ACE/Server)"
• Maybe in reply to: Michael Bauer: "Cryptanalysis of SecurID (ACE/Server)"
• Next in thread: John Moore: "RE: Cryptanalysis of SecurID (ACE/Server)"
• Reply: John Moore: "RE: Cryptanalysis of SecurID (ACE/Server)"

Michael Bauer writes:
> Has anybody performed or know of a cryptanalysis of the time-based
> password system used by Security Dynamics' SecurID - ACE/Server system? I
> heard a rumor that "holes" had been found in it.

It matters little. One time tokens are of limited utility in an
environment where you can seize an unprotected link after the one time
token is used to authenticate. In a world of TCP hijacking, who cares
if the one time system is good?

PErry

• Next message: Mok-Kong Shen: "Re: Some General Questions on Cryptography"
• Previous message: vinnie@vmeng.com: "Re: Cryptanalysis of SecurID (ACE/Server)"
• Maybe in reply to: Michael Bauer: "Cryptanalysis of SecurID (ACE/Server)"
• Next in thread: John Moore: "RE: Cryptanalysis of SecurID (ACE/Server)"
• Reply: John Moore: "RE: Cryptanalysis of SecurID (ACE/Server)"