NAME

ocra_tool —

create and view OCRA credential files

SYNOPSIS

ocra_tool info -f credential_file

ocra_tool init -f credential_file -s suite_string -k key [-c counter] [-p pin | -P pin_hash] [-q kill_pin | -Q kill_pin_hash] [-w counter_window] [-t timestamp_offset]

ocra_tool sync -f credential_file -c challenge -r response -v second_response

DESCRIPTION

The ocra_tool utility is used to initialize and view OCRA credential files used by the pam_ocra(8) authentication service module for PAM.

info

Show content of OCRA credential file.

-f credential_file: the OCRA credential file.

init

Initialize OCRA credential file.

-f credential_file: the OCRA credential file.
-s suite_string: OCRA suite string.
-k key: specified as hexadecimal string.
-c counter: If the suite_string requires a counter parameter, counter is the initial counter value. If counter begins with '0x' it will be interpreted as hexadecimal number.
-p pin | -P pin_hash: If the suite_string requires a pin-hash parameter, it is either set as hexadecimal string pin_hash or calculated from pin using the pin-hash algorithm in suite_string.
-q kill_pin | -Q kill_pin_hash: If the suite_string requires a pin-hash parameter, it is optional to provide a kill pin. If this pin is used, the the authentication fails, all future authentications also fail. The kill pin is set as hexadecimal string kill_pin_hash or calculated from kill_pin using the pin-hash algorithm in suite_string.
-w counter_window: If the suite_string requires a counter parameter, counter_window specifies the maximum number of verify attempts pam_ocra(8) will make (while incrementing the counter value). This parameter is optional.
-t timestamp_offset: If the suite_string requires a timestamp parameter, timestamp_offset specifies the number of timestamp steps pam_ocra(8) will make while verifying a response. The verify process will start at (current_timestamp - timestamp_offset) and end at (current_timestamp + timestamp_offset). This parameter is optional.

sync

Synchronize the counter with two responses from the OTP device. Based on a user selectable challenge and two subsequent responses it is possible to brute force the counter in the OTP device. When the counter is found, the database is updated. The counter is searched from 0 to UINT_MAX.

-f credential_file: the OCRA credential file.
-c challenge: Challenge entered in the OTP device.
-r response: First response for the given challenge.
-v second response: Second response for the given challenge.

EXAMPLE

$ ocra_tool init -f ~/.ocra -s OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1 \

-k 00112233445566778899aabbccddeeff00112233 \

-c 10 -p 1234 -w 50

$ ocra_tool info -f ~/.ocra

suite: OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1

key: 0x00112233445566778899aabbccddeeff00112233

counter: 0x000000000000000a

counter_window: 50

pin_hash: 0x7110eda4d09e062aa5e4a390b0a572ac0d2c0220

kill_pin_hash: NOT SET

kill pin used: false

FILES

~/.ocra: OCRA credential file

AUTHOR

ocra_tool and this manual page were developed by Stefan Grundmann.