Software token

<h2 id="security-architecture">Security architecture</h2>
<p>There are two primary architectures for software tokens: <a href="/facts/Shared_secret/ATRz7LXy">shared secret</a> and <a href="/facts/Public-key_cryptography/gowoFTxS">public-key cryptography</a>.  
</p><p>For a shared secret, an <a href="/facts/Network_administrator/UIwK6HTt">administrator</a> will typically generate a <a href="/facts/Configuration_file/DDzU0FLJ">configuration file</a> for each end-user. The file will contain a username, a <a href="/facts/Personal_identification_number/DGMvGdJf">personal identification number</a>, and the <a href="/facts/Shared_secret/ATRz7LXy">secret</a>. This configuration file is given to the user.
</p><p>The shared secret architecture is potentially vulnerable in a number of areas. The configuration file can be compromised if it is stolen and the token is copied. With time-based software tokens, it is possible to borrow an individual's <a href="/facts/Personal_digital_assistant/fLTT1Uqy">PDA</a> or laptop, set the clock forward, and generate codes that will be valid in the future. Any software token that uses shared secrets and stores the PIN alongside the shared secret in a software client can be stolen and subjected to offline attacks. Shared secret tokens can be difficult to distribute, since each token is essentially a different piece of software. Each user must receive a copy of the secret, which can create time constraints.
</p><p>Some newer software tokens rely on <a href="/facts/Public-key_cryptography/gowoFTxS">public-key cryptography</a>, or asymmetric cryptography. This <a href="/facts/Software_architecture/1Hokp0Ed">architecture</a> eliminates some of the traditional weaknesses of software tokens, but does not affect their primary weakness (ability to duplicate). A PIN can be stored on a remote authentication <a href="/facts/Server_(computing)/dEaYFD7r">server</a> instead of with the token client, making a stolen software token no good unless the PIN is known as well. However, in the case of a virus infection, the cryptographic material can be duplicated and then the PIN can be captured (via keylogging or similar) the next time the user authenticates. If there are attempts made to guess the PIN, it can be detected and logged on the authentication server, which can disable the token. Using asymmetric cryptography also simplifies implementation, since the token client can generate its own key pair and exchange public keys with the server.
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Authentication/64y4S69b">Authentication</a></li>
<li><a href="/facts/Electronic_authentication/VTewE0wc">Electronic authentication</a></li>
<li><a href="/facts/Google_Authenticator/h1n1LPlW">Google Authenticator</a></li>
<li><a href="/facts/Multi-factor_authentication/186gpx8R">Multi-factor authentication</a></li>
<li><a href="/facts/Security_token/0V55fErB">Security token</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://www.neowin.net/news/microsoft-to-abandon-passwords">Microsoft to abandon passwords</a></li>
<li><a href="http://it.slashdot.org/article.pl?sid=05/10/19/2340245&tid=172&tid=95">Banks to Use 2-factor Authentication by End of 2006</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>Chung, Joaquin; Jung, Eun-Sung; Kettimuthu, Rajkumar; Rao, Nageswara S.V.; Foster, Ian T.; Clark, Russ; Owen, Henry (2018-02-01). "Advance reservation access control using software-defined networking and tokens". Future Generation Computer Systems. 79: 225–234. doi:10.1016/j.future.2017.03.010. OSTI 1394409. <a href="https://doi.org/10.1016%2Fj.future.2017.03.010" target="_blank">https://doi.org/10.1016%2Fj.future.2017.03.010</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>SecurityPro News Strong Authentication Retrieved on April 3, 2007. <a href="http://www.securitypronews.com/2004/0121.html" target="_blank">http://www.securitypronews.com/2004/0121.html</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
</ol>

Software token open-in-new

Software token