NAME

       otpw-gen - one-time password generator

SYNOPSIS

       otpw-gen [ options ]

DESCRIPTION

       OTPW  is  a one-time password authentication system. It can be plugged into any application that needs to
       authenticate users interactively.  One-time password authentication  is  a  valuable  protection  against
       password eavesdropping, especially for logins from untrusted terminals.

       Before  you  can  use  OTPW  to  log into your system, two preparation steps are necessary. Firstly, your
       system administrator has to enable it. (This is usually done by configuring your  login  software  (e.g.,
       sshd) to use OTPW via the Pluggable Authentication Module (PAM) configuration files in /etc/pam.d/.)

       Secondly, you need to generate a list of one-time passwords and print it out. This can be done by calling

              otpw-gen | lpr

       or something like

              otpw-gen -h 70 -s 2 | a2ps -1B -L 70 --borders no

       if more control over the layout is desired.

       You  will  be  asked  for a prefix password, which you need to memorize. It has to be entered immediately
       before the one-time password. The prefix password reduces the risk that anyone who finds or  steals  your
       password printout can use that alone to impersonate you.

       Each one-time password will be printed behind a three digit password number. Such a number will appear in
       the password prompt when OTPW has been activated:

              Password 026:

       When  you  see  this  prompt,  enter  the memorized prefix password, followed immediately by the one-time
       password identified by the number. Any spaces within a  password  have  only  been  inserted  to  improve
       legibility  and  do  not  have to be copied.  OTPW will ignore the difference between the easily confused
       characters 0O and Il1 in passwords.

       In some situations, for example if multiple logins occur simultaneously for the same user,  OTPW  defends
       itself against the possibility of various attacks by asking for three random passwords simultaneously.

              Password 047/192/210:

       You  then  have  to  enter  the  prefix  password,  followed  immediately by the three requested one-time
       passwords. This fall-back mode is activated by the existence of the lock file ~/.otpw.lock.   If  it  was
       left over by some malfunction, it can safely be deleted manually.

       Call  otpw-gen  again when you have used up about half of the printed one-time passwords or when you have
       lost your password sheet. This will disable all remaining passwords on the previous sheet.

OPTIONS

       -h number     Specify the total number of lines per page to be sent to standard output. This number minus
                     four header lines determines the number of rows of passwords  on  each  page.  The  maximum
                     number of passwords that can be printed is 1000. (Minimum: 5, default: 60)

       -w number     Specify the maximum width of lines to be sent to standard output. This parameter determines
                     together  with  the  password  length the number of columns in the printed password matrix.
                     (Minimum: 64, default: 79)

       -s number     Specify the number of form-feed separated pages to be sent to standard output. (Default: 1)

       -e number     Specify the minimum entropy of each one-time password in bits. The length of each  password
                     will  be  chosen  automatically,  such  that  there  are  at  least two to the power of the
                     specified number possible passwords. A value below 30 might make the  passwords  vulnerable
                     to  a  brute-force  guessing  attack.  If the attacke might have read access to the ~/.otpw
                     file, the value should be at least 48.  Paranoid  users  might  prefer  long  high-security
                     passwords with at least 60 bits of entropy.  (Default: 48)

       -p0           Generate  passwords  by  transforming  a  random  bit string into a sequence of letters and
                     digits, using a form of base-64 encoding (6 bits per character). (Default)

       -p1           Generate passwords by transforming a random bit string into a  sequence  of  English  four-
                     letter words, each chosen from a fixed list of 2048 words (2.75 bits per character).

       -f filename   Specify  a  file to be used instead of ~/.otpw for storing the hash values of the generated
                     one-time passwords.

AUTHOR

       The OTPW package, which includes the otpw-gen progam, has been developed by Markus Kuhn. The most  recent
       version is available from <http://www.cl.cam.ac.uk/~mgk25/otpw.html>.

SEE ALSO

       pam(8), pam_otpw(8)

                                                   2003-09-30                                        OTPW-GEN(1)