So I was listening to Security Now! from grc.com and Steve Gibson was talking about using a second form of authentication for his employees to login to a special webapp to work from home. So the idea was to create a "one-time" password system that you add to your username and password much like paypal now allows you to use a dongle with the 5 digits that change based on an algorithm. Steve's Perfect Paper Password method takes a hash of some secret (most likely random for each user and stored like salt fPublish Postor a hash), then does a 256 hash and passes it into a AES encryption method along with a number to indicate with card like 0, 1, 2.
Well, Steve implemented the whole thing in assembly langauge and I thought it would be cool to have it in a native C# implementation. Well it turns out the 256 hash methods and the AES encryption (Rijndael Cypher) are included in the .NET 2.0 framework (didn't check 1.1). So to implement the basic algorithm was less than a page of code. I will continue to work on it as I have time and perhaps make it as an optional component of logging into my website.
DeadHeads Hit Henderson in 2016
9 years ago
