🚀 go-pugleaf

I went to the `Which Computer Show' in Birmingham last week to see if there
were any new security products. I was disappointed in this - blame the
recession perhaps - but there was a neat system idea from the local Datalock 
distributor. He sends out one-time passwords via the paging system.

A purist might argue that a really serious attacker would monitor the paging
channel. If so, it strikes me that you only need to make a small modification.

Issue each of your users with a (unique) Latin square and a personal number.
Let them use the square to perform substitutions (and if required
permutations  
and hashings as well) of the digits of their personal number, and those they 
get from the pager, to generate a one-time password. Number lengths and
algorithm complexity will depend on your view of (a) the intelligence of
your programmers and (b) the analytic skill and persistence of your opponents.

A lot of firms sell products, such as password generators, which offer better
access security than simple logon passwords. At $20,000 for a controller plus
$200 for each generator, this can add up to too much money for most sites.

However many sites already give out pagers, and those who don't might well do
so if they could get system security as an added benefit.

Ross Anderson