1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
Readme for Donkey
Kazuhiko Yamamoto
kazu@is.aist-nara.ac.jp
Peter Pentchev
roam@ringlet.net
April 18, 2016
<What's Donkey?>
Donkey is an alternative for S/KEY's "key" command. The new feature that
the original key doesn't have is print an entry for skeykeys as
follows;
kazu 0099 al02004 115d83956f1089b6 Apr 26,1995 22:13:27
This means that donkey is also an alternative for "keyinit". Since the
entry is printed to stdout (not to /etc/skeykeys), you can easily send
it to a remote operator by e-mail (with a PGP signature or something).
So, it is possible to initiate S/KEY without logging in from the console of
the host.
The name "Donkey" is an acronym of "Don't Key".
<How to use Donkey>
(1) Calculate a One-Time-Password.
Execute Donkey with a sequence number and a seed, then input your passphrase.
% donkey 80 is12345
Enter passphrase : xxxxxxxxxxxxxxxxxxxxxxx
SOFT O SAW SWAB CON RODE
You can choose the hash function from MD4 and MD5.
% donkey 80 is12345
Enter passphrase : xxxxxxxxxxxxxxxxxxxxxxx
SOFT O SAW SWAB CON RODE
%donkey -f md5 80 is12345
Enter passphrase : xxxxxxxxxxxxxxxxxxxxxxx
LACK WIN ROSE ANNA STUN REEK
The default hash function is MD4 due to historical reasons.
(2) Calculate several One-Time-Passwords at once.
Use the -n option.
% donkey -n 10 80 is12345
Enter passphrase : xxxxxxxxxxxxxxxxxxxxxxx
71: WORE HELL CUB FAR DORA MALE
72: SAIL DAN DONE BEER DAYS MOS
73: PAN TONE THAT TOUT BURY EST
74: KEN ROAM HEAT NAN MEAN HEN
75: MINI MARS HASH BOTH SITU SING
76: TOW SHIN FLUE ARID AHOY NE
77: SLID LEEK NO TREE STOW BEY
78: RUDY WINE GIFT FUSS AGEE SUE
79: GELD THIN MAID THIN BUD TURF
80: SOFT O SAW SWAB CON RODE
Note that though "Enter passphrase" is printed out to stderr,
the One-Time-Passwords are printed to stdout. So, you can redirect
the output safely.
(3) Print skeykeys entry.
Use the -i option without arguments. Then, enter a login name, a sequence
number and a seed. If you like the default values, just hit Return.
Input your passphrase twice to get the entry.
% donkey -i
Enter login name [default kazu]:
Enter sequence 1 to 999 [default 99]:
Enter new seed [default ur18122]:
Please choose passphrase between 8 and 256 characters.
Enter passphrase : xxxxxxxxxxxxxxxxxxxxxxxxxxx
Re-enter passphrase : xxxxxxxxxxxxxxxxxxxxxxxxxxx
kazu 0099 ur18122 fc5b023e684968ff Oct 02,1995 16:15:30
WINK SEAM GRAB ROAD HELL FEST
<Copyright>
Donkey conforms to the GNU GENERAL PUBLIC LICENSE Version 2.
<Availability>
Donkey is available at http://devel.ringlet.net/security/donkey/ and developed
in a GitLab repository at https://gitlab.com/donkey/donkey
<Things to do>
* Support other one time passwords such as OTP.
* Support other secure hash functions.
That's it.
|