SKEY(3)

SKEY(3) | Library Functions Manual | SKEY(3)

# NAME

`skey`, `skeychallenge`, `skeylookup`, `skeygetnext`, `skeyverify`, `skeyzero`, `getskeyprompt`, `skey_set_algorithm`, `skey_get_algorithm`, `skey_haskey`, `skey_keyinfo`, `skey_passcheck`, `skey_authenticate` —
one-time password (OTP) library

# LIBRARY

S/key One-Time Password Library (libskey, -lskey)

# SYNOPSIS

`#include <skey.h>`

int
`skeychallenge`(struct skey *mp, const char *name, char *ss, size_t sslen);

int
`skeylookup`(struct skey *mp, const char *name);

int
`skeygetnext`(struct skey *mp);

int
`skeyverify`(struct skey *mp, char *response);

int
`skeyzero`(struct skey *mp, char *response);

int
`getskeyprompt`(struct skey *mp, char *name, char *prompt);

const char *
`skey_set_algorithm`(const char *new);

const char *
`skey_get_algorithm`(void);

int
`skey_haskey`(const char *username);

const char *
`skey_keyinfo`(const char *username);

int
`skey_passcheck`(const char *username, char *passwd);

int
`skey_authenticate`(const char *username);

void
`f`(char *x);

int
`keycrunch`(char *result, const char *seed, const char *passwd);

void
`rip`(char *buf);

char *
`readpass`(char *buf, int n);

char *
`readskey`(char *buf, int n);

int
`atob8`(char *out, const char *in);

int
`btoa8`(char *out, const char *in);

int
`htoi`(int c);

const char *
`skipspace`(const char *cp);

void
`backspace`(char *buf);

void
`sevenbit`(char *buf);

char *
`btoe`(char *engout, const char *c);

int
`etob`(char *out, const char *e);

char *
`put8`(char *out, const char *s);

# DESCRIPTION

The `skey` library provides routines for accessing NetBSD's one-time password (OTP) authentication system.

Most S/Key operations take a pointer to a struct skey, which should be considered as an opaque identifier.

# FUNCTIONS

The following high-level functions are available:

`skeychallenge`(mp, name, ss, sslen)
  Return a S/Key challenge for user name. If successful, the caller's skey structure mp is filled and 0 is returned. If unsuccessful (e.g. if name is unknown), -1 is returned.
`skeylookup`(mp, name)
  Find an entry for user name in the one-time password database. Returns 0 if the entry is found and 1 if the entry is not found. If an error occurs accessing the database, -1 is returned.
`skeygetnext`(mp)
  Get the next entry in the one-time password database. Returns 0 on success and the entry is stored in mp and 1 if no more entries are available. If an error occurs accessing the database, -1 is returned.
`skeyverify`(mp, response)
  Verify response response to a S/Key challenge. Returns 0 if the verification is successful and 1 if the verification failed. If an error occurs accessing the database, -1 is returned.
`skeyzero`(mp, response)
  Comment out user's entry in the S/Key database. Returns 0 on success and the database is updated, otherwise -1 is returned and the database remains unchanged.
`getskeyprompt`(mp, name, prompt)
  Issue a S/Key challenge for user name. If successful, fill in the caller's skey structure mp and return 0. If unsuccessful (e.g. if name is unknown) -1 is returned.

The following lower-level functions are available:

`skey_set_algorithm`(new)
  Set hash algorithm type. Valid values for new are "md4", "md5" and "sha1".
`skey_get_algorithm`(void)
  Get current hash type.
`skey_haskey`(username)
  Returns 0 if the user username exists and 1 if the user doesn't exist. Returns -1 on file error.
`skey_keyinfo`(username)
  Returns the current sequence number and seed for user username.
`skey_passcheck`(username, passwd)
  Checks to see if answer is the correct one to the current challenge.
`skey_authenticate`(username)
  Used when calling program will allow input of the user's response to the challenge. Returns zero on success or -1 on failure.

The following miscellaneous functions are available:

`f`(x)
  One-way function to take 8 bytes pointed to by x and return 8 bytes in place.
`keycrunch`(char *result, const char *seed, const char *passwd)
  Crunch a key.
`rip`(buf)
  Strip trailing CR/LF characters from a line of text buf.
`readpass`(buf, n)
  Read in secret passwd (turns off echo).
`readskey`(buf, n)
  Read in an s/key OTP (does not turn off echo).
`atob8`(out, in)
  Convert 8-byte hex-ascii string in to binary array out. Returns 0 on success, -1 on error.
`btoa8`(out, in)
  Convert 8-byte binary array in to hex-ascii string out. Returns 0 on success, -1 on error.
`htoi`(int c)
  Convert hex digit to binary integer.
`skipspace`(cp)
  Skip leading spaces from the string cp.
`backspace`(buf)
  Remove backspaced over characters from the string buf.
`sevenbit`(buf)
  Ensure line buf is all seven bits.
`btoe`(engout, c)
  Encode 8 bytes in c as a string of English words. Returns a pointer to a static buffer in engout.
`etob`(out, e)
  Convert English to binary. Returns 0 if the word is not in the database, 1 if all good words and parity is valid, -1 if badly formed input (i.e. > 4 char word) and -2 if words are valid but parity is wrong.
`put8`(out, s)
  Display 8 bytes s as a series of 16-bit hex digits.

# FILES

/usr/lib/libskey.a
  static skey library
/usr/lib/libskey.so
  dynamic skey library
/usr/lib/libskey_p.a
  static skey library compiled for profiling

# SEE ALSO

skey(1), skeyaudit(1), skeyinfo(1)

# BUGS

The `skey` library functions are not re-entrant or thread-safe.

The `skey` library defines many poorly named functions which pollute the name space.

November 10, 2001 | NetBSD 9.0