Security token

A security token is a peripheral device used to gain access to electronically restricted resources. It serves as a tool to prove a user's identity, often working alongside a password or replacing one entirely. These devices can store various types of sensitive information. This includes passwords, cryptographic keys for digital signatures, or even biometric data like fingerprints.

By using these tokens, systems can ensure that only authorized individuals can access private data or physical locations.

Tokens function through several different mechanisms to transmit secret information. In a static password token, the device holds a password that remains physically hidden from the user. This password is transmitted during each authentication attempt, though it is vulnerable to replay attacks. A synchronous dynamic password token uses a timer to rotate through combinations created by a cryptographic algorithm. For this to work, the token and the authentication server must have synchronized clocks. If the clocks drift apart, the system may fail, though some systems like RSA's SecurID allow users to re-synchronize by entering consecutive passcodes.

Other tokens use different mathematical approaches to generate security codes. Asynchronous password tokens generate a one-time password without needing a clock. They may use a one-time pad or a specific cryptographic algorithm to do this. Some systems use a complex mathematical process called a hash chain. This creates a series of one-time passwords from a secret shared key. Each password is unique and observably unpredictable. Even if an adversary learns previous passwords, they cannot guess the next one.

Challenge-response tokens use public key cryptography to prove possession of a private key without actually revealing that key. The server sends an encrypted challenge, and the device proves it has the matching private key by decrypting it.

Security tokens are categorized by how they connect to a computer or user. Disconnected tokens have no physical or logical connection to the client computer. These are very common in two-factor authentication for online identity. They usually feature a built-in screen that displays authentication data, which the user must enter manually via a keypad.

Connected tokens, however, must be physically attached to the device. These include smart cards that require a reader or USB tokens that plug into a port. Once connected, these tokens can automatically transmit information, which removes the need for manual entry.

Wireless technologies allow for even more variety in token design. Contactless tokens form a logical connection without needing physical contact. This makes them convenient for electronic payments or keyless entry systems. These often use Radio-frequency identification (RFID) to transmit data. However, researchers at Johns Hopkins University and RSA Laboratories found that RFID tags could be cracked or cloned. Bluetooth tokens provide another wireless option, often using Bluetooth Low Energy to extend battery life. Near-field communication (NFC) tokens can also be used, sometimes working alongside Bluetooth to provide both proximity and data provision.

There are specific physical formats and standards that define these devices. Smart cards are a widespread form of connected token and can be very inexpensive, costing around ten cents. While they are efficient, their computational performance is often limited by low power requirements and thin designs. Some USB tokens actually contain a smart card chip inside to combine the benefits of both formats. In the United States, certain token designs are certified to meet the FIPS 140 federal security standard. This certification indicates that the device has undergone rigorous testing and independent audits to ensure high cryptographic security.

Security tokens play a vital role in modern digital infrastructure and software protection. A related application is the hardware dongle, which is used to prove ownership of specific computer programs. The software accesses the dongle to authorize its own use. Furthermore, some single sign-on (SSO) solutions use tokens to store software that allows for seamless authentication. By storing a cryptographic hash of a password on the token, these systems protect the actual password even if the device is compromised. While theft and loss remain the simplest vulnerabilities, these tools provide a robust layer of defense for many digital systems.