# Practical usage of S/KEY

The One-Time-Password (OTP) topic became quite popular in the recent years. But unlike the well-known HOTP and TOTP standards I haven't heard about any applications/systems implementing and using the S/KEY standard. Are there any?

-
You know that S/KEY and OTP have serious problems if they are used on their own (e.g., over an insecure channel, or if the user does not carefully check who they are authenticating to every time), right? That might be why you haven't heard of much deployed use of it. –  D.W. Feb 21 '14 at 1:19

There is OpenBSD, where you can use S/KEY for login-purposes.

Check the OpenBSD – Frequently Asked Questions:

# 8.10 - S/Key

S/Key is a one-time password'' authentication system. It can be useful for people who don't have the ability to use an encrypted channel which protects their authentication credentials in transit, as can be established using ssh(1).

WARNING: One-time password systems only protect authentication information. They do not prevent network eavesdroppers from gaining access to private information. Furthermore, if you are accessing a secure system A, it is recommended that you do this from another trusted system B, to ensure nobody is gaining access to system A by logging your keystrokes or by capturing and/or forging input and output on your terminal devices.

The S/Key system generates a sequence of one-time (single use) passwords from a user's secret passphrase along with a challenge received from the server, by means of a secure hash function. The system is only secure if the secret passphrase is never transferred over the network. Therefore initializing or changing your secret passphrase MUST be done over a secure channel, such as ssh(1) or the console.

OpenBSD's S/Key implementation can use a variety of algorithms as the one-way hash function. The following algorithms are available:

• md4
• md5
• sha1
• rmd160.

-