It seems really simple, but who invented the commonly-used otpauth:// scheme (used by Google Authenticator and other TOTP soft tokens by scanning QR codes)? When?
4
“Let’s get into the Wayback machine, Sherman.”
otpauth:// starts with Google as nearly as I can find, in https://github.com/google/google-authenticator/commit/6649dd33687c5561663fb242a05f6949cf4d543f, dated Mar 25, 2010. But the initial commit says it was to ‘Import BlackBerry source code and project files.’ So it came before…
The formal root of all this is RFC-2289 “A One-Time Password System” that was pulled together by the Network Working Group by Haller (Bellcore), Metz (Kaman Sciences Corporation), Nesser (Nesser & Nesser Consulting) and Straw (Bellcore), copyrighted in February 1998 by ‘The Internet Society’).
(https://www.rfc-editor.org/rfc/rfc2289)
In this document, Haller’s paper is referenced “The S/KEY One-Time Password System” in the Proceedings of the ISOC Symposium on Network and Distributed System Security, in February 1994. (http://zoo.cs.yale.edu/classes/cs422/2014/bib/haller94skey.pdf)
This document references the UNIX skey command, “S/key — a procedure to use one time passwords for accessing computer systems” by Karn, Haller, Walden, and Chasin, with the earliest online generation found in October 1993. (http://www.sbras.ru/cgi-bin/www/unix_help/unix-man?skey+1)
Phil Karn worked at Bell Labs and BellCore, and wrote most of the skey unix software. He since has been working on many Internet systems with security concerns, and is now at Qualcomm. Neil Haller worked at Bell Labs and BellCore and carried the skey flag forward. Haller was born in 1937 and passed in 2011. John Walden created the first MS-DOS CLient version of skey. Scott Chasin was at Bellcore in 1993 and contributed to skey. He has since gone on to head several companies some more and some less connected to computer security.
Skey was based on original work by Leslie Lamport, an ACM Turing Award recipient, who developed a method for creating digital signatures (“Constructing digital signatures from a one way function.” Technical Report SRI-CSL-98, SRI International Computer Science Laboratory in October 1979 and , “Password Authentication with Insecure Communication”, Communications of the ACM 24.11 in November 1981.) As a sidenote, where quantum communications looks to be able to hack passwords, Lamport signatures may not be breakable under sufficient conditions. (https://en.wikipedia.org/wiki/Leslie_Lamport and https://en.wikipedia.org/wiki/Lamport_signature)
Skey has fallen from prominence as schemes that feature two-factor authentication are becoming adopted. But it is the realization of Lamport’s one-time-password authentication by the gang of scientists at Bell Labs.
We all stand on the shoulders of giants.
0