| 4.1 |  | AAA Secure Network Access |
| 4.1.5 |  | Authentication - one time passwords - S/Key |

| Some remote logins send passwords over networks as clear text. An eavesdropper could capture these passwords and use them to gain unauthorized access to systems. One way to create passwords that can be safely sent over remote connections is to use a one-way hashing algorithm to create a one-time password scheme. This is what S/Key does.

S/Key uses either MD4 or MD5, one-way hashing algorithms developed by Ron Rivest, to create a one-time password system. In this system, passwords are sent in clear text over the network. However, after a password has been used, it is no longer useful to the eavesdropper. The biggest advantage of S/Key is that it protects against eavesdroppers without modification of client software and imposes only marginal inconvenience to the users.

The S/Key system involves three main components:

- The client
- The host
- A password calculator

The client is responsible for providing the login shell to the user. It does not contain any persistent storage for password information. The host is responsible for processing the user login request. It stores the current one-time password as well as the login sequence number in a file. The host is also responsible for providing the client with a seed value. The password calculator is a one-way hashing function, which is defined as a function that loses information each time it is applied. The network protocol between the client and the host is completely independent of the scheme.