A USB dongle for one-time passwords
Loaded and Secured
OpenKubus is now ready, but it doesn't know your secrets. The stick-write tool in firmware/create-stick loads the three pieces of information into the EEPROM. A tool for preparing the stick does not exist as of this writing, so some manual work is now required: The -p option expects 48 characters – 32 bytes of AES key, a 14-digit data block, and two octets of the first serial numbers, without any separators.
The tool uses USB to transfer the command-line arguments to the stick without converting them. If you want to transfer binaries, you need to modify the source code. The -l option tells the firmware not to accept any more initial passwords. Of course, you could use the programmer to harden the stick, but this means that it will not accept firmware updates either.
Most Linux distributions use PAM to authenticate users. This means that you can teach programs like login or sshd new authentication methods. OpenKubus includes its own module in the software/PAM/ directory that requires the PAM developer files from libpam0gdev. A call to make install copies it to the /lib/security/ directory and modifies the privileges. After completing the installation, and working as root, configure the modules in /etc/pam.conf or in the /etc/pam.d/ directory. Adding
auth sufficient pam_openkubus.so
to auth-common tells PAM to accept the stick  as an alternative in the future.
To verify the authenticity of a password, the PAM module needs to know the stick's secrets. To allow this to happen, the administrator will store a line matching the user password serial_number format in /etc/openkubus-passwd. PAM compares the data with the input from the stick. Make sure the file is only readable by the root user.
If you want to check input from OpenKubus in your own applications without resorting to PAM, the lean OpenKubus library is a useful option that the project offers for many programming languages. The library itself is written in C, but the SWIG wrapper gives Python, Ruby, Java, Perl, or PHP access to its functionality . Right now, the API only includes the following function:
int openkubus_authenticate(const char *pad,const char *pw, int offset, int num);
This function expects the one-time password to check as the first argument and the AES key as the second. The last two arguments are an optional serial number offset (which defaults to 0) and the serial number itself. If successful, the function returns the serial number; if not, it returns a negative value.
The library only checks the password; it does not access a file. Developers who use OpenKubus need to manage the current serial number, the initial password, and the offset themselves. The sample network server in software/server/, which compares one-time passwords with a list, gives you an idea of how to manage these parameters.
Carnegie Mellon researchers say 3 million pages could fall down the phishing hole in the next year.
The US government rolls new best-practice rules for protecting SSH.
Klaus Knopper announces the latest version of his iconic Live Linux system.
DARPA and NICTA release the code for the ultra-secure microkernel system used in aerial drones.
Should you trust an online service to store your online passwords?
New B+ board lets you build cool things without the complication of a powered USB hub.
Redmond rushes in to root out alleged malware haven.
New initiative will bring futuristic virtual reality effects to the web surfing experience.