Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 11:48 am

All times are UTC + 1 hour




Post new topic Reply to topic  [ 2 posts ] 
Author Message
PostPosted: Tue May 20, 2008 8:08 pm 
Offline

Joined: Tue May 13, 2008 12:24 am
Posts: 49
Q: I'm not entirely sure that I understand how the server decrypts the token it receives, since it's encrypted with the device id as the key,how does it know what key to use for decryption?

A: The OTP is not encrypted with the id. It is a separate symmetrical key, unique to each device. The basic principle to verify the blob is as follows:

1. Extract the public ID prefix (sent in clear text = the first characters - 32)
2. Use this prefix to check up in the database which AES key this particular ID has
3. Decrypt the OTP part using this key (last 32 characters = 128 bits)
4. Verify that the checksum matches
5. Verify that the private ID matche
6. Verify that the counter- and timer values match


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Thu Jun 19, 2008 9:42 am 
Offline
Site Admin
Site Admin

Joined: Tue May 06, 2008 7:22 pm
Posts: 151
We got a question to forum@yubico as follows:

Quote:
In point 2 you say: "Use this prefix to check up in the database which
AES key this particular ID has"
Will this lookup be in the local database or in a remote database? If
it will be local does the database need to be synchronized?


The lookup is done in the local database. The intention is that you only ever store the AES key in just one database, so there is no need to synchronize anything. If you need to validate OTPs from any other place, you should use the web service client API instead of trying to decrypt the OTP.

I hope this answers the question.

Thanks,
Simon


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group