This article's factual accuracy is disputed. Review the definitions of "Security Token" and "Security Token Generator". Relevant discussion may be found on the talk page. Please help to ensure that disputed statements are reliably sourced.(November 2024) (Learn how and when to remove this message)
A security token is a peripheral device used to gain access to an electronically restricted resource. The token is used in addition to, or in place of, a password. Examples of security tokens include wireless key cards used to open locked doors, a banking token used as a digital authenticator for signing in to online banking, or signing transactions such as wire transfers.
All tokens contain some secret information used to prove identity. There are four different ways in which this information can be used:
Static password token: The device contains a password that is physically hidden (not visible to the possessor), but is transmitted for each authentication. This type is vulnerable to replay attacks.
Synchronous dynamic password token: A timer is used to rotate through various combinations produced by a cryptographic algorithm. The token and the authentication server must have synchronized clocks.
Asynchronous password token: A one-time password is generated without the use of a clock, either from a one-time pad or cryptographic algorithm.
Challenge–response token: Using public key cryptography, it is possible to prove possession of a private key without revealing that key. The authentication server encrypts a challenge (typically a random number, or at least data with some random components) with a public key; the device proves it possesses the corresponding private key by providing the decrypted challenge.
Time-synchronized one-time passwords change at a set interval; e.g., once per minute. To do this, some sort of synchronization must exist between the client's token and the authentication server. For disconnected tokens, this time synchronization is done before the token is distributed to the client. Other token types do the synchronization when the token is inserted into an input device. The main problem with time-synchronized tokens is that they can, over time, become unsynchronized. However, some such systems, such as RSA's SecurID, allow the user to re-synchronize the server with the token, sometimes by entering several consecutive passcodes. Most also cannot have replaceable batteries and only last up to 5 years before needing replacement, so there is an additional cost.
Another type of one-time password uses a complex mathematical algorithm, such as a hash chain, to generate a series of one-time passwords from a secret shared key. Each password is unique, even when previous passwords are known. The open-source OATH algorithm is standardized;[citation needed] other algorithms are covered by US patents. Each password is observably unpredictable and independent of previous ones, so an adversary would be unable to guess the next password, even with knowledge of all previous passwords.
Tokens can contain chips with functions varying from very simple to very complex, including multiple authentication methods.
The simplest security tokens do not need any connection to a computer. The tokens have a physical display; the authenticating user simply enters the displayed number to log in. Other tokens connect to the computer using wireless techniques, such as Bluetooth. These tokens transfer a key sequence to the local client or to a nearby access point.
Alternatively, another form of token that has been widely available for many years is a mobile device which communicates using an out-of-band channel (like voice, SMS, or USSD).
Still other tokens plug into the computer and may require a PIN. Depending on the type of the token, the computerOS will then either read the key from the token and perform a cryptographic operation on it, or ask the token's firmware to perform this operation.[citation needed]
A related application is the hardware dongle required by some computer programs to prove ownership of the software. The dongle is placed in an input device and the software accesses the I/O device in question to authorize the use of the software in question.
Commercial solutions are provided by a variety of vendors, each with their own proprietary (and often patented) implementation of variously used security features. Token designs meeting certain security standards are certified in the United States as compliant with FIPS 140, a federal security standard. Tokens without any kind of certification are sometimes viewed as suspect, as they often do not meet accepted government or industry security standards, have not been put through rigorous testing, and likely cannot provide the same level of cryptographic security as token solutions which have had their designs independently audited by third-party agencies.[citation needed]
Disconnected tokens
A disconnected token. The number must be copied into the PASSCODE field by hand.
Disconnected tokens have neither a physical nor a logical connection to the client computer. They typically do not require a special input device, and instead use a built-in screen to display the generated authentication data, which the user enters themselves manually via a keyboard or keypad. Disconnected tokens are the most common type of security token used (usually in combination with a password) in two-factor authentication for online identification.
Connected tokens
Connected tokens are tokens that must be physically connected to the computer the user is authenticating on. Tokens in this category automatically transmit authentication information to the client computer upon physical connection, eliminating the need for the user to manually enter it. However, in order to use a connected token, the appropriate input device must be installed. The most common types of physical tokens are smart cards and USB tokens (also called security keys), which require a smart card reader and a USB port. FIDO2 tokens, supported by the open specification group FIDO Alliance have become popular for consumers with mainstream browser support beginning in 2015 and supported by popular websites and social media sites.[citation needed]
Older PC card tokens are made to work primarily with laptops. Type II PC Cards are preferred as tokens because they are half as thick as Type III.
The audio jack port is a relatively practical method to establish a connection between mobile devices, such as iPhone, iPad, and Android, and other accessories.[citation needed] The most well known device is called Square, a credit card reader for iOS and Android devices.
Many connected tokens use smart card technology. Smart cards can be very cheap (around ten cents)[citation needed] and contain proven security mechanisms (as used by financial institutions, like cash cards). The computational performance of smart cards is limited because of extremely low power consumption and ultra-thin form-factor requirements.
Smart-card-based USB tokens, which contain a smart card chip inside, provide the functionality of both USB tokens and smart cards. They enable a broad range of security solutions and provide the abilities and security of a traditional smart card without requiring a unique input device. From the computer operating system's point of view, such a token is a USB-connected smart card reader with a single non-removable smart card installed.
Contactless tokens
Unlike connected tokens, contactless tokens form a logical connection to the client computer but do not require a physical connection. The absence of the need for physical contact makes them more convenient than both connected and disconnected tokens. As a result, contactless tokens are a popular choice for keyless entry systems and electronic payment solutions such as MobilSpeedpass, which uses RFID to transmit authentication info from a keychain token.[citation needed] However, there have been various security concerns raised about RFID tokens after researchers at Johns Hopkins University and RSA Laboratories discovered that RFID tags could be easily cracked and cloned.
Another downside is that contactless tokens have relatively short battery lives; usually only 5–6 years, which is low compared to USB tokens, which may last more than 10 years.[citation needed] Some tokens do allow the batteries to be changed, thus reducing costs.
The Bluetooth Low Energy protocols provide a long-lasting battery lifecycle for wireless transmission.
The transmission of inherent Bluetooth identity data is the lowest quality for supporting authentication.
A bidirectional connection for transactional data interchange serves for the most sophisticated authentication procedures.
The automatic transmission power control attempts to estimate the radial distance. The escape is available apart from the standardised Bluetooth power control algorithm to provide a calibration on minimally required transmission power.
Bluetooth tokens are often paired with a USB token, thus working in both connected and disconnected states. Bluetooth authentication works when closer than 32 feet (9.8 meters). When the Bluetooth link is not properly operable, the token may be inserted into a USBinput device to function.
Another combination is with a smart card to store locally larger amounts of identity data and process information as well. Another is a contactless BLE token that combines secure storage and tokenized release of fingerprint credentials.
In USB mode of operation, sign-off requires care when handling the token while it is mechanically coupled to the USB plug. The advantage of the Bluetooth mode of operation is the ability to combine sign-off with distance metrics. The respective products are in preparation, following the concept of an electronic leash.
NFC tokens
Near-field communication (NFC) tokens, combined with a Bluetooth token, may operate in several modes, working in both connected and disconnected states. NFC authentication works when closer than 1 foot (0.3 meters).[citation needed] The NFC protocol bridges short distances to the reader while the Bluetooth connection serves for data provision with the token to enable authentication. Also when the Bluetooth link is not connected, the token may serve the locally stored authentication information in coarse positioning to the NFC reader and relieves from exact positioning to a connector.[citation needed]
Single sign-on software tokens
Some types of single sign-on (SSO) solutions, like enterprise single sign-on, use a token to store information that enables seamless authentication and password filling. As passwords are stored on the token, users need not remember them and can therefore select more secure ones or have them assigned. Most tokens store a cryptographic hash of the password, so that if the token is compromised, the password remains protected.
Programmable tokens
Programmable tokens are marketed as "drop-in" replacement of mobile applications such as Google Authenticator (miniOTP). They can be used as a mobile app replacement and in parallel as a backup.
Vulnerabilities
Loss and theft
The simplest vulnerability with any password container is theft or loss of the device. The chances of this happening, or happening unaware, can be reduced with physical security measures such as locks, an electronic leash, or a body sensor and alarm. Stolen tokens can be made useless by using two factor authentication. Commonly, in order to authenticate, a personal identification number (PIN) must be entered along with the information provided by the token at the same time as the output of the token.
Attacking
Any system that allows users to authenticate via an untrusted network (such as the Internet) is vulnerable to man-in-the-middle attacks. In this type of attack, an attacker acts as a "go-between" between the user and the legitimate system, soliciting the token output from the legitimate user and then supplying it to the authentication system. Since the token value is mathematically correct, the authentication succeeds, and the fraudster is granted access. In 2006, Citibank was the victim of an attack when its hardware-token-equipped business users fell prey to a large Ukrainian-based man-in-the-middle phishing operation.
Breach of codes
In 2012, the Prosecco research team at INRIA Paris-Rocquencourt developed an efficient method of extracting the secret key from several PKCS #11 cryptographic devices. These findings were documented in INRIA Technical Report RR-7944, ID hal-00691958, and published at CRYPTO 2012.
Digital signature
Trusted as a regular handwritten signature, the digital signature must be created with a private key known only to the person authorized to sign. Tokens that allow secure on-board generation and storage of private keys enable secure digital signatures, and can also be used for user authentication, as the private key also serves as a proof of the user's identity.
For tokens to identify the user, each token must have a unique number. Not all approaches fully qualify as digital signatures according to some national laws.[citation needed] Tokens with no on-board keyboard or another user interface cannot be used in some signing scenarios, such as confirming a bank transaction based on the bank account number that the funds are to be transferred to.
