Open source two-factor authentication system released

Open source two-factor authentication system released

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Open source two-factor authentication system released owen.nick 09-01-2005
Posted by on September 1, 2005, 9:23 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hate passwords? We are pleased to announce that we've released an open
source version
of the WiKID Strong Authentication System.. The project website is
here:

https://sourceforge.net/projects/wikid-twofactor/

Here is a brief overview what we have released:

>> The WiKID Strong Authentication OSS server
>> A J2SE WiKID token client
>> Initial validation scripts (ASP) for automating new user additions
>> The windows dll network client component (for ASP apps, e.g.)
>> The java network client component (for jsp apps, e.g.)
>> Example jsp script for use writing your own WiKID protected jsp pages
>> TACACS+ and Openldap network clients - with more on the way

The WiKID Strong Authentication Systems is a robust, flexible, scalable
and secure two-factor authentication platform. Features include:

>> Easy to use web-based management
>> Replication for fault-tolerance
>> Highly scalable architecture
>> Each server supports multiple security domains pointed at difference
network resources
>> Each client supports of multiple domains - across multiple servers
>> Each user can have multiple clients in different locations
>> Configure passcode lifetime, PIN length, max bad PIN attempts and max
bad passcode attempts by domain
>> Automated user validation based on existing trusted credentials
>> No hardware token required; can be run from a USB token
>> Easier to use and more extensible than, yet as secure as a key fob token
>> More secure and easier to implement than client certificates
>> Extensible across multiple enterprises
>> Perfect for web-based applications, remote access and non-employee
strong authentication such as online banking
>> Open source, with commercial support available.

If you manage multiple servers in multiple locations and use the same
passwords for
all of them, you should really check out WiKID. Feedback and
contributions very much appreciated.

Nick



Posted by Volker Birk on September 1, 2005, 6:40 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
owen.nick@gmail.com wrote:
> Hate passwords? We are pleased to announce that we've released an open
> source version
> of the WiKID Strong Authentication System.. The project website is
> here:
> https://sourceforge.net/projects/wikid-twofactor/

Hm... advertizing in usenet news...

OK, please help me:

What is the difference between a password to memorize and a PIN to
memorize?

On http://www.wikidsystems.net/ I'm reading:

------------------------------- snip --------------------------------------
How does it work?

When the user wants to log in, they select the domain they want to log into
(yes, WiKID is capable of handling multiple domains with a single client
unlike hardware tokens) and enter their PIN. The PIN and a single-use AES
symmetric key is encrypted by the server's public key. The server
decrypts the OTP request. If the PIN is correct and the account active, the
server generates the OTP and encrypts it with the token client's
public key and the single-use AES key. The user gets the OTP and uses it to
log in. Whatever service the user is trying to log into passes the OTP and
username back to the WiKID server for validation via a network client
connection.
------------------------------- snip --------------------------------------

If the difference you see between PIN and password is, that a PIN is very
short and has very few entropy, how do you prevent brute forcing the PIN
by trying many connections at a time (simulated) by many users?

If timeouts or blocking are the answer, how do you want to prevent easy
DoS attacks?

BTW: why the single-use symmetric key, if the data sent is additionally
encrypted with user's public key?

Yours,
VB.
--
"Es kann nicht sein, dass die Frustrierten in Rom bestimmen, was in
deutschen Schlafzimmern passiert".
Harald Schmidt zum "Weltjugendtag"


Similar ThreadsPosted
Re: Open-source bug hunt results posted March 11, 2006, 4:23 pm
Open source implementation of the SEED algorithm? February 24, 2007, 12:27 am
Software writers spot open source in Sony BMG CDs November 20, 2005, 4:00 pm
Advice for minimal password security on an open source app February 27, 2007, 10:34 am
REVIEW: "Intellectual Property and Open Source", Van Lindberg January 5, 2009, 1:15 pm
Authentication Open vs Shared Key September 12, 2007, 9:17 am
Secure web authentication system w/o SSL and PKI February 10, 2008, 6:33 am
Looking for system/device authentication solution for web app February 8, 2006, 9:12 am
SSL Server authentication, SSL client authentication, SSL connection and SSL session August 14, 2006, 1:05 pm
WEP authentication, why WEP authentication scheme is flawed and how it can be attacked August 1, 2006, 12:51 pm

The site map in XML format XML site map

Contact Us | Privacy Policy