OTP S/KEY - 种子是如何生成的，它们每次都是随机的吗？
我正在考虑开发一个一次性密码身份验证系统（用于手机的 j2me，用于服务器端的 php）
我正在尝试了解整个过程，这是我对
- user > 的理解将随机秘密（S）输入到哈希中 n 次
- user >提交S^n到服务器
- server>保存n和S^n
- 用户>生成(S^n)-1并提交给服务器
- server>接受用户输入并再次应用散列函数 1 次，并根据之前存储的散列进行检查
现在，通过阅读 RFC2289（S/Key），当用户输入唯一标识符（在步骤 4）这个种子是如何创建的，它是随机的还是存储的。
I'm looking at developing a One-time Password authentication system (j2me for phone, php for server side)
I'm trying to get my head around the process, here is what i understand
- user > inputs random secret (S) into hash n number of times
- user > submits S^n to server
- server > saves n and S^n
- user > generates (S^n)-1 and submits to server
- server > takes user input and applies hashing function 1 more time and checks it against previously stored hash
Now, from reading RFC2289 (S/Key) There is a seed that is issued to the client and concatenated with the user's secret when they input a unique identifier (at step 4) How is this seed created, is it random, is it stored.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在密码序列初始化期间，服务器和客户端同意种子。因此，在使用 OTP 进行身份验证之前，只需执行一次。种子应该是随机的，但客户端应该能够选择它。换句话说，服务器可能会建议随机种子，但客户端应该可以选择提出自己的（随机）种子。然后种子应该由服务器存储。 服务器实际上在身份验证期间并不使用它。它存储它只是为了在身份验证期间将其与序列号一起呈现给用户。种子和序列号都不是秘密。
The seed is agreed upon by the server and the client during initialization of the password sequence. It is therefore done only once before OTPs are used for authentication. The seed should be random but the client should be able to choose it. In other words the server may suggest a random seed but the client should have an option to come up with his own (random) seed. The seed should then be stored by the server. The server actually doesn't use it during authentication. It stores it just so that it can present it to the user during authentication, together with the sequence number. Both seed and sequence number are not secret.