The client proves that K has successfully been regenerated. The client uses K to unlock private data or facilitate authentication to other servers. As with traditional techniques, throttling and lockout mechanisms prevent brute force attacks online. However, neither server has enough information to generate K, so the compromise of a single server would not disclose the password or private data. This technique is implemented in currently shipping VeriSign enterprise PKI offerings.
Alternative implementations are in development.
The Digital Signature TrustID is a portable Internet identity credential. The TrustID is an X.509 v3 certificate issued in accordance with the ABA TrustID policy. The DST TrustID is currently issued for browsers and email clients, smart cards, and USB tokens. TrustIDs are backed by a contract infrastructure and warranty program. Customers have requested roaming credentials to support the use of TrustIDs on any Internet-accessible computer.