3 ms·

I'm not sure if I understand how this would work, and I'm curious - I believe the majority of SecurID tokens are used as a part of two-factor authentication to

• rlpb 15y ago
  See for example http://ftsafe.com/products/ePass1000.html http://ftsafe.com/products/ePass1000.html. The device uses its own random number generator to create an RSA keypair. The private key never leaves the device. The public key will leave the device and be available for checking on the authentication server (usually by being signed and that signature checked on the authentication server). When authentication is required, the server sends a challenge to the device ("sign this"). The device signs it with its private key, which no other device can do. This way it's impossible for a single point of failure to compromise the entire system during operation, like it has here with SecureID. The authentication server might be compromised, but that could happen in any system and it would only need that server to be rebuilt. There are attacks against this system too of course - for example the RNG could be compromised on the devices themselves, or there could be an attack allowing the extraction of a private key due to a design flaw. But the single point of failure as in this case doesn't exist.