Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading about the S/KEY One-Time Password system on wikipedia here and was wondering why the server only stores a single password and not the list of one-time passwords like the client does. In other words, why is the implementation not a simply a password-to-password compare but instead a cryptographic hash function is run on the password and then the result of that hash function is compared to the previous One-Time-Password the client sent to the server?

share|improve this question
up vote 1 down vote accepted

Applying the hash function assures that only the next password in sequence will be valid. There is no reason to store the previous state, or the client's original secret. Once a valid key is used, the server stores the hash of it (which is the same algorithm used to generate the list of hashes in the first place.) This puts the burden of storage on the client, meaning the server doesn't need a 1000 rows in the database for each user.

Of course, this algorithm was developed in the days before hardware boxes capable of testing 1.5 trillion hashes per second were commercially available.

share|improve this answer
Is the burden of storage issue more related to who is responsible if the passwords are leaked versus storage capability? – Nate Jun 3 '13 at 23:43
It started as both, really. S/KEY makes storage and the key change mechanism simple on the server, and the user's secret is always protected (as much as a hash can protect a password.) And the amount of storage per user is fixed. This used to be critically important in the days of mag tape and punch cards, long before the advent of terabyte drives and SANs. These days we think nothing of keeping megabyte sized digital photos of users, and storing a few extra kilobytes of keys wouldn't make much of an impact. The concern today is the inadequacy of hashing as a protection mechanism. – John Deters Jun 4 '13 at 13:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.