A USB dongle for one-time passwords
Loaded and Secured
OpenKubus is now ready, but it doesn't know your secrets. The stick-write tool in firmware/create-stick loads the three pieces of information into the EEPROM. A tool for preparing the stick does not exist as of this writing, so some manual work is now required: The -p option expects 48 characters – 32 bytes of AES key, a 14-digit data block, and two octets of the first serial numbers, without any separators.
The tool uses USB to transfer the command-line arguments to the stick without converting them. If you want to transfer binaries, you need to modify the source code. The -l option tells the firmware not to accept any more initial passwords. Of course, you could use the programmer to harden the stick, but this means that it will not accept firmware updates either.
Most Linux distributions use PAM to authenticate users. This means that you can teach programs like login or sshd new authentication methods. OpenKubus includes its own module in the software/PAM/ directory that requires the PAM developer files from libpam0gdev. A call to make install copies it to the /lib/security/ directory and modifies the privileges. After completing the installation, and working as root, configure the modules in /etc/pam.conf or in the /etc/pam.d/ directory. Adding
auth sufficient pam_openkubus.so
to auth-common tells PAM to accept the stick  as an alternative in the future.
To verify the authenticity of a password, the PAM module needs to know the stick's secrets. To allow this to happen, the administrator will store a line matching the user password serial_number format in /etc/openkubus-passwd. PAM compares the data with the input from the stick. Make sure the file is only readable by the root user.
If you want to check input from OpenKubus in your own applications without resorting to PAM, the lean OpenKubus library is a useful option that the project offers for many programming languages. The library itself is written in C, but the SWIG wrapper gives Python, Ruby, Java, Perl, or PHP access to its functionality . Right now, the API only includes the following function:
int openkubus_authenticate(const char *pad,const char *pw, int offset, int num);
This function expects the one-time password to check as the first argument and the AES key as the second. The last two arguments are an optional serial number offset (which defaults to 0) and the serial number itself. If successful, the function returns the serial number; if not, it returns a negative value.
The library only checks the password; it does not access a file. Developers who use OpenKubus need to manage the current serial number, the initial password, and the offset themselves. The sample network server in software/server/, which compares one-time passwords with a list, gives you an idea of how to manage these parameters.
But you can still be a non-voting “individual supporter” if you pay the money
Several current systems could fall victim to the attack
Latest Linux engine comes with better graphics and support for Intel's new power-saving chips.
Hackers send a message of beauty and liberation to server logs
Citrix gets excited about new Pi-Powered XenDesktop client system
Linux on Azure cert heralds a new era for Redmond.
Proposals for presentations at the CeBIT Open Source Forum will be accepted through 24 January 2016.
Adobe looks for a new start; renames its embattled Flash tool.
The Pi's popular Raspbian OS pursues secrecy without entropy.
VMware bids for a stake in the container industry with a bold effort to integrate containers with its classic virtualization system.