In both cases, a user has a small credit card size device with a calculator style display. Within the device, a small micro-processor is running an encryption or hashing algorithm. Two of the most popular algorithms are DES and MD5, respectively. When a remote user tries to authenticate, the RAS will request the user's name, password, and the digits currently displayed on the token. The RAS looks up, in its database, the user name, password, and the token algorithm and by also running the algorithm, compares its results to the number entered.
Authentication is confirmed if the numbers match.
The challenge response version has a few additional steps. After the user enters their user name and password, the RAS sends the user a six digit random number, called the challenge. The user enters the number in their token card via its calculator-like keypad. The RAS, knowing the user's algorithm and the challenge, performs the same operation. Authentication occurs when the responses match.