OTPW
cryptographic software
OTPW is a one-time password system developed for authentication in Unix-like operating systems by Markus Kuhn. A user's real password is not directly transmitted across the network. Rather, a series of one-time passwords is created from a short set of characters (constant secret) and a set of one-time tokens. As each single-use password can only be used once, passwords intercepted by a password sniffer or key logger are not useful to an attacker.
OTPW is supported in Unix and Linux (via pluggable authentication modules), OpenBSD, NetBSD, and FreeBSD, and a generic open source implementation can be used to enable its use on other systems.
OTPW, like the other one-time password systems, is sensitive to a man in the middle attack if used by itself. This could for example be solved by putting SSL, SPKM or similar security protocol "under it" which authenticates the server and gives point-to-point security between the client and server.
Design and differences from other implementations
Unlike S/KEY, OTPW is not based on the Lamport's scheme in which every one-time password is the one-way hash value of its successor. Password lists based on the Lamport's scheme have the problem that if the attacker can see one of the last passwords on the list, then all previous passwords can be calculated from it. It also does not store the encrypted passwords as suggested by Aviel D. Rubin in Independent One-Time Passwords, in order to keep the host free of files with secrets.
“OTPW” enters the record as cryptographic software. Crown Archives preserves that source wording while asking what OTPW, cryptographic and software can confirm, complicate or overturn.
Why this record matters
“OTPW” is worth following because a concise public description often conceals a longer documentary argument. Here, OTPW, cryptographic and software provides the most credible route into that argument.
Datasets, specimens, observations and peer-reviewed methods provide the appropriate test for the technical claims summarized here. The source revision retrieved here is dated Oct 16, 2024. The linked authority identifier is Q7073101. None of the 0 selected statements returned an explicit reference.
Current terminology should not be projected backward without checking the classification used when the underlying evidence was created. The lead is largely declarative, so disagreement and counter-evidence require a deliberate search beyond the opening account. Authority statements aid reconciliation but still require their own references, qualifiers and ranks to be checked.
How to read it
Check terminology, classification and the date of the cited evidence. Scientific names and technical consensus can change while older records retain historical value.
- Current terminology
- Classification context
- Finding cited technical literature
Primary datasets, specimen catalogues, standards bodies and the most recent peer-reviewed literature.
Three-step research path
- Establish the record: confirm the title “OTPW”, its source revision and the description used here.
- Expand the search: follow OTPW primary sources, OTPW archive and OTPW research across catalogues and specialist indexes.
- Test the account: compare the strongest cited source with the responsible institution’s current record and note any disagreement.
Questions for further research
- Which source most directly establishes the central claim about “OTPW”?
- Has classification or technical consensus changed since the cited source?
- Which observation, specimen, dataset or publication supports the account?
Search terms from this dossier
This entry incorporates text from “OTPW” on English Wikipedia. Contributors are listed in the page history. Text is available under the Creative Commons Attribution-ShareAlike 4.0 License. Selected authority identifiers and statements are retrieved from Wikidata under CC0; their references and qualifiers remain part of the verification path.