Prakticky to vyzkousene nemam, ale dal jsem "SKEY" do Googlu. Na to mi vypadla stranka The S/Key Password System, kde je to v odstavci How It Works dost srozumitelne popsano:
"A user initializes S/KEY by selecting a secret password and n, a number of passwords to generate. A secure hash function (currently MD4) is applied to the secret password n times. The result is stored on the server. When the user attempts to log in, the server issues a challenge, which is the number n-1. Software on the user's client machine prompts for her secret password, and applies n-1 iterations of the hash function to it, and sends this response to the server. The server applies the hash function to this response. If the result it obtains is the same as the value it stored earlier, the authentication worked. The user is allowed in, and the server replaces the stored value with the response obtained from the client, and decrements the password counter. [Haller, 1994; Rubin, 1995]"
Tzn. implementace zcela trivialni: Uzivatel ti nejak zada originalni heslo. Ty tohle heslo N-krat prozenes nejakou hash funkci (skoro bych radsi doporucoval jinou nez MD4, MD5 a SHA1) a ulozis si do databaze vysledek a taky cisla N a X=N. Az se bude chtit uzivatel prihlasit, tak mu napises, "uzivateli, posli mi svoje heslo X-krat prohnane hashovaci funkci H". Protoze svoje tajne heslo zna, tak to dokaze a ten hash ti posle. Ty to prozenes dalsimi (N-X) hashi a porovnas s tim, co je v databazi. Pokud to sedi, je heslo spravne, pokud to nesedi, je heslo spatne. Tak jako tak zmensis X o 1. Pokud dosahnes jednicky (resp. z bezpecnostnich duvodu by bylo lepsi zastavit se nekde vys, treba u desitky), tak uzivatele pozadas, at si zvoli nove heslo. |
Registrace nového uživatele 
