Re: Cryptocard

Hello People!!!

Do you think certificate storing USB tokens like Rainbow or Alladin would be
safer? and better too. For one, you don't need a centralised server and the
use of certificates offers better security than regular two factor tokens?


Siddhartha - Muscat 23.36N 58.38E

----- Original Message ----- 
From: "Joel M Snyder" <[email protected]>
To: "Travis Watson" <[email protected]>
Cc: <[email protected]>; "Rudi Pierquin" <[email protected]>
Sent: Sunday, August 31, 2003 9:34 PM
Subject: Re: [VPN] Cryptocard


> >I don't know if cryptocard is
> >peer-to-peer or master-slave (Joel, can you answer
> >this for us, please?), but I would be nervous about a
> >master-slave setup if that's what it is.
>
> Yes, CryptoCard has the same style as Safeword---centralized knowledge,
but
> distributed knowledge.  In fact, I have had good experiences with Safeword
as
> well in recent years (got a pile of tokens in front of me as I speak), but
> never used them in production because they don't support OpenVMS as a
server.
>
> There is a human-factors issue with distributed servers and CryptoCard.
> CryptoCard is often used in "reduced input" mode, which means that the
server
> keeps some state between queries; it lets the user avoid putting in the
> challenge if you (the network manager) don't want to require it.  In
essence,
> in reduced input mode, the token & the server kind of agree on what the
> challenge will be the next time, and the token shows it---if the server
asks
> for the same challenge that the token is giving, then the user just
presses
> ENTER instead of putting in the challenge.   (for those of you who care,
the
> next challenge is based on additional bits out of the encryption that the
> CryptoCard does but which are not displayed, so it is under control of the
> server, not some synchronized algorithm like SecurID uses.)
>
> If you flop around between servers, then you can't use reduced input (or,
more
> precisely, the user will perceive that they always have to enter the
> challenge), so most people who use CryptoCard tend to have multiple
servers,
> but the servers are ordered (i.e., failover, not active load sharing) so
that
> the same card tends to hit the same server all the time.  That doesn't
mean you
> can't load balance them across regions, just that your users will be
happier if
> you don't.
>
> So that's a long answer to the question.  The short answer is "yes, you
can
> have lots of servers."  It's just that when you set it up, you need to be
> cognizant of the human interface issues related to the product as well as
the
> IT reliability issues.
>
> But I would agree with Willie 100%: I like the idea that I don't have a
single
> server which has the "core knowledge;" I can distribute the knowledge
around by
> sharing the token's secret among a bunch of different servers using
CryptoCard
> and that makes it more attractive to me.
>
> jms
>
> Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719
> Phone: +1 520 324 0494 x101 (v) +1 520 324 0495 (FAX)
> [email protected]    http://www.opus1.com/jms    Opus One
> _______________________________________________
> VPN mailing list
> [email protected]
> http://lists.shmoo.com/mailman/listinfo/vpn