S/Key is a simple one-time password system that takes an initial shared secret, and uses it as the seed for iterative hashes (using a cryptographically-strong one-way hash function, like MD4, MD5, SHA-1, etc.) which, taken in reverse, become the one-time passwords you use to login.

initializing S/Key

in order to establish the initial shared secret, you need to be logged in via a secure connection (SSH). you then run skeyinit, which will prompt you for your regular monkey Unix password, and then ask you to set a password to seed the S/Key password generation:

% skeyinit Password (or `s/key'): enter monkey Unix password here Reminder - Only use this method if you are directly connected or have an encrypted channel. If you are using telnet or rlogin, exit with no password and use keyinit -s. Enter secret password: enter temporary S/Key password here Again secret password: duh ID username skey is otp-md5 99 naug33833 Next login password: JOLT LAD BEER GLUE SEW HUGO %

generating S/Key OTPs

on-the-fly OTP generation: if you have a PalmPilot, you can use PilotOTP to generate OTPs using your temporary S/Key password.

one-time password lists: to generate a list of OTPs to carry in your wallet, run skeyprint (it will spit Postscript data on stdout, so direct it to a file):

% skeyprint > mykeys.ps Reminder - Do not use this program while logged in via telnet or rlogin. Enter secret password: enter temporary S/Key password here %

you will then have a Postscript file (mykeys.ps) you can print and cut out to put in your wallet. werd.

using OTPs

you simply need to telnet (or SSH - we run a hacked-up version of sshd) to monkey, and at login, enter your monkey username, and s/key as your password. you will then be prompted for your S/Key OTP. look it up on your sheet of OTPs, or generate it using the seed value given, your temporary S/Key password, and the password number. enter it in exactly.

OpenBSD/i386 (naughty.monkey.org) (ttyp9) login: username Password: s/key otp-md5 98 naug33834 Response: YOU MID COME DUAL REEL NEIL Last login: Sun Mar 8 14:53:13 on ttyp0 from 152.160.231.150 OpenBSD-current (NAUGHTY) #0: Fri Feb 27 01:51:04 EST 1998 ...