RSA 钥匙扣如何工作？
谁能用简单的编程术语向我解释一下这些 RSA 密钥加密狗是如何工作的？ 我知道暴雪为《魔兽世界》和贝宝以及一些交易网站提供了它们。
谢谢！
Could anyone explain to me in simple programmatic terms how these RSA key dongles work? I know Blizzard has them for WoW and paypal as well as some of the trading sites.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
密钥卡有一个时钟和一个序列号，用作 PRNG 的种子。 当您点击“显示代码”按钮时，密钥卡会显示一个数字，该数字是该时间戳和通过 PRNG 运行的序列号的乘积。 服务器知道您的密钥的序列号和时间，并执行相同的操作。 如果您的代码匹配，则您已通过身份验证。
您可以在服务器端计算前一个/后一个 N 值以考虑时钟偏差。
The fob has a clock and a serial number that is used as a seed for a PRNG. When you hit the "show me a code" button, the fob displays a number that is the product of that timestamp and the serial number run through the PRNG. The server knows your fob's serial number and time, and does the same operation. If your codes match, you're authenticated.
You can calculate the previous/next N values on the server end to account for clock skew.
程序化术语不是必需的。 想象一下有两个硬件（您的加密狗和公司的某个东西）在相同的定期安排的时间间隔生成相同的数字。 由于某些专有算法，几乎不可能猜测该号码是什么，因此，如果您输入的号码（或由加密狗自动发送的号码）与服务器上的号码匹配，您的身份就会得到验证。
至少对于我拥有的加密狗，您还必须提供只有您和服务器知道的密码。 因此，为了获得认证，您需要身体上的东西和头脑中的东西。 这种组合很难伪造。 即使有人得到了加密狗，除非他们知道您的密码，否则它毫无价值。 如果他们知道您的密码，那么如果没有加密狗，这些信息就毫无价值。
Programmatic terms aren't necessary. Just imagine two pieces of hardware (your dongle and something at the company) that generate the same numbers at the same regularly scheduled intervals. It would be virtually impossible to guess what the number is due to some proprietary algorithms, so if the number you type in (or is automatically sent by the dongle) matches the number at the server, your identity is validated.
At least with the dongle I have, you also have to supply a pin known only by you and the server. So, in order to be authenticated you need both something physical and something in your head. That combination is pretty hard to fake. Even if someone gets the dongle, unless they know your pin it's worthless. And if they know your pin, that information is worthless without the dongle.
现在就安全！ 第 103 集 讲述了它们的工作原理。 （该链接指向节目笔记，但页面顶部有一个指向音频播客的链接。）
基本上，密钥卡与服务器同步，并且它们都被播种以生成相同的伪随机序列数字。 如果您在正确的时间输入正确的号码，服务器就会知道是您。
Security Now! episode 103 talks about how they work. (That link is to the show notes, but there's a link at the top of the page to the audio podcast.)
Basically, the key fob is synchronized with a server and they're both seeded to generate the same sequence of pseudo-random numbers. The server knows it's you if you input the right number at the right time.