OTPW-GEN(1)						      General Commands Manual						       OTPW-GEN(1)

NAME

       otpw-gen - one-time password generator

SYNOPSIS

       otpw-gen [ options ]

DESCRIPTION

       OTPW  is  a one-time password authentication system. It can be plugged into any application that needs to authenticate users interactively.
       One-time password authentication is a valuable protection against password eavesdropping, especially for logins from untrusted terminals.

       Before you can use OTPW to log into your system, two preparation steps are necessary. Firstly, your system administrator has to enable  it.
       (This  is usually done by configuring your login software (e.g., sshd) to use OTPW via the Pluggable Authentication Module (PAM) configura-
       tion files in /etc/pam.d/.)

       Secondly, you need to generate a list of one-time passwords and print it out. This can be done by calling

	      otpw-gen | lpr

       or something like

	      otpw-gen -h 70 -s 2 | a2ps -1B -L 70 --borders no

       if more control over the layout is desired.

       You will be asked for a prefix password, which you need to memorize. It has to be entered immediately before  the  one-time  password.  The
       prefix password reduces the risk that anyone who finds or steals your password printout can use that alone to impersonate you.

       Each one-time password will be printed behind a three digit password number. Such a number will appear in the password prompt when OTPW has
       been activated:

	      Password 026:

       When you see this prompt, enter the memorized prefix password, followed immediately by the one-time password identified by the number.  Any
       spaces  within  a  password  have  only	been inserted to improve legibility and do not have to be copied.  OTPW will ignore the difference
       between the easily confused characters 0O and Il1 in passwords.

       In some situations, for example if multiple logins occur simultaneously for the same user, OTPW defends itself against the  possibility	of
       various attacks by asking for three random passwords simultaneously.

	      Password 047/192/210:

       You  then  have	to enter the prefix password, followed immediately by the three requested one-time passwords. This fall-back mode is acti-
       vated by the existence of the lock file ~/.otpw.lock.  If it was left over by some malfunction, it can safely be deleted manually.

       Call otpw-gen again when you have used up about half of the printed one-time passwords or when you have lost your password sheet. This will
       disable all remaining passwords on the previous sheet.

OPTIONS

       -h number     Specify  the total number of lines per page to be sent to standard output. This number minus four header lines determines the
		     number of rows of passwords on each page. The maximum number of passwords that can be printed is 1000. (Minimum: 5,  default:
		     60)

       -w number     Specify the maximum width of lines to be sent to standard output. This parameter determines together with the password length
		     the number of columns in the printed password matrix. (Minimum: 64, default: 79)

       -s number     Specify the number of form-feed separated pages to be sent to standard output. (Default: 1)

       -e number     Specify the minimum entropy of each one-time password in bits. The length of each password will be chosen automatically, such
		     that  there  are  at least two to the power of the specified number possible passwords. A value below 30 might make the pass-
		     words vulnerable to a brute-force guessing attack. If the attacke might have read access  to  the	~/.otpw  file,	the  value
		     should  be at least 48. Paranoid users might prefer long high-security passwords with at least 60 bits of entropy.  (Default:
		     48)

       -p0	     Generate passwords by transforming a random bit string into a sequence of letters and digits, using a form of base-64  encod-
		     ing (6 bits per character). (Default)

       -p1	     Generate passwords by transforming a random bit string into a sequence of English four-letter words, each chosen from a fixed
		     list of 2048 words (2.75 bits per character).

       -f filename   Specify a file to be used instead of ~/.otpw for storing the hash values of the generated one-time passwords.

AUTHOR

       The OTPW package, which includes the otpw-gen progam, has been developed by  Markus  Kuhn.  The	most  recent  version  is  available  from
       <http://www.cl.cam.ac.uk/~mgk25/otpw.html>.

SEE ALSO

       pam(8), pam_otpw(8)

								    2003-09-30							       OTPW-GEN(1)