SKey

SKey, often written as S/Key, is a one-time password (OTP) authentication scheme that uses a cryptographic hash chain to generate a sequence of passwords, each of which is used only once. The system aims to prevent replay attacks by ensuring that previously used passwords cannot be reused.

How it works: The user and the authentication server share a secret seed and a chosen hash function. Starting from a secret value p0, the user constructs a chain where pi+1 = H(pi). The server stores the initial value p0. For a login, the user presents p1; the server hashes p1 to see if it equals p0. If it matches, the login succeeds and the server updates its stored value to p1. On the next login, the user provides p2, and the server verifies by hashing p2 to obtain p1, and so on. Because each password in the chain can be used only once, each successful login advances the server’s expectation along the chain, providing forward-proof of authentication without transmitting a secret over the network.

History and usage: SKey emerged in the 1990s as an early, widely deployed OTP system, notably used in UNIX environments and various remote-access scenarios. It demonstrated the practicality of hash-chain-based authentication and influenced later OTP designs and standards.

Advantages and limitations: SKey offers resistance to replay attacks and does not require transmitting a secret value during authentication. However, it requires careful management of the chained passwords; once the chain is exhausted or lost, reinitialization is needed. If a server-side copy of the current chain element is compromised, a limited number of future logins could be abused. SKey also laid groundwork for successor OTP approaches such as HOTP/TOTP within broader authentication ecosystems.