RFE: generate seeds

[jekader]

RFE: generate seeds

[cernekee]

Early versions of stoken supported the stoken export --random syntax, which generated a plausible-looking CTF string with a random token seed. There is nothing special about the seed value itself; it is just 16 random hex bytes.

Current versions also support stoken issue --template foo.xml, which outputs a mostly-valid SDTID file with a random seed. The optional template file allows the user to customize various parameters and informational fields. This is still a bit experimental, and it is known that current versions of the RSA TokenConverter utility reject these files because they do not have a valid batch signature. However, stoken itself can still convert these into v2/v3/blocks/iPhone/QR formats through something like stoken export --file in.sdtid --iphone.

At some point it would be nice to write a PAM module or a simple RADIUS server that uses libstoken to verify user-supplied OTPs. Ideally this would also support hard tokens; it's relatively straightforward to roll out a new software token implementation (client + server) from scratch, but there are only a few sources of tamper-proof devices like SID700.

[jekader]

Wow, that was fast. Thank you for explaining this. Generated a seed successfully. I think it's worth documenting this feature and eventually someone will pick it up to create a PAM/RADIUS wrapper.

I totally agree that sending out private keys defeats the whole point of OTP as they can be intercepted/stolen. Who knows, maybe we'll once see an open hardware project that will produce actual hardware tokens :)

[cernekee]

stoken issue probably isn't used very much, but it is documented in the man page...

Anyway, I'll go ahead and close this ticket. If you have any other questions just holler.

Thanks.