page_title: RSA SecurID
section_title: Description
hierarchical_section_title: RSA SecurID / Description
caption_attribution_description: English: An RSA SecurID SID700 token without USB connector Deutsch: Ein RSA SecurID SID700-Token ohne USB-Anschluß Français&#160;: Un jeton RSA SecurID SID700 sans connecteur USB
context_page_description: RSA SecurID, formerly referred to as SecurID, is a mechanism developed by RSA for performing two-factor authentication for a user to a network resource.
context_section_description: The RSA SecurID authentication mechanism consists of a "token" — either hardware (e.g. a key fob) or software (a soft token) — which is assigned to a computer user and which creates an authentication code at fixed intervals (usually 60 seconds) using a built-in clock and the card's factory-encoded almost random key (known as the "seed"). The seed is different for each token, and is loaded into the corresponding RSA SecurID server (RSA Authentication Manager, formerly ACE/Server) as the tokens are purchased. On-demand tokens are also available, which provide a tokencode via email or SMS delivery, eliminating the need to provision a token to the user.
  The token hardware is designed to be tamper-resistant to deter reverse engineering. When software implementations of the same algorithm ("software tokens") appeared on the market, public code had been developed by the security community allowing a user to emulate RSA SecurID in software, but only if they have access to a current RSA SecurID code, and the original 64-bit RSA SecurID seed file introduced to the server. Later, the 128-bit RSA SecurID algorithm was published as part of an open source library. In the RSA SecurID authentication scheme, the seed record is the secret key used to generate one-time passwords.  Newer versions also feature a USB connector, which allows the token to be used as a smart card-like device for securely storing certificates.
  A user authenticating to a network resource—say, a dial-in server or a firewall—needs to enter both a personal identification number and the number being displayed at that moment on their RSA SecurID token. Though increasingly rare, some systems using RSA SecurID disregard PIN implementation altogether, and rely on password/RSA SecurID code combinations. The server, which also has a real-time clock and a database of valid cards with the associated seed records, authenticates a user by computing what number the token is supposed to be showing at that moment in time and checking this against what the user entered.
  On older versions of SecurID, a "duress PIN" may be used—an alternate code which creates a security event log showing that a user was forced to enter their PIN, while still providing transparent authentication. Using the duress PIN would allow one successful authentication, after which the token will automatically be disabled. The "duress PIN" feature has been deprecated and is not available on currently supported versions.
  While the RSA SecurID system adds a layer of security to a network, difficulty can occur if the authentication server's clock becomes out of sync with the clock built into the authentication tokens. Normal token clock drift is accounted for automatically by the server by adjusting a stored "drift" value over time. If the out of sync condition is not a result of normal hardware token clock drift, correcting the synchronization of the Authentication Manager server clock with the out of sync token (or tokens) can be accomplished in several different ways. If the server clock had drifted and the administrator made a change to the system clock, the tokens can either be resynchronized one-by-one, or the stored drift values adjusted manually. The drift can be done on individual tokens or in bulk using a command line utility.
  RSA Security has pushed forth an initiative called "Ubiquitous Authentication", partnering with device manufacturers such as IronKey, SanDisk, Motorola, Freescale Semiconductor, Redcannon, Broadcom, and BlackBerry to embed the SecurID software into everyday devices such as USB flash drives and cell phones, to reduce cost and the number of objects that the user must carry.
caption: RSA SecurID token (model SID700)
exif: {"Image ImageDescription": "", "Image Make": "SONY", "Image Model": "DSC-T7", "Image Orientation": "Horizontal (normal)", "Image XResolution": "72", "Image YResolution": "72", "Image ResolutionUnit": "Pixels/Inch", "Image DateTime": "2008:12:15 23:53:50", "Image YCbCrPositioning": "Co-sited", "Image ExifOffset": "256", "Image PrintIM": "[80, 114, 105, 110, 116, 73, 77, 0, 48, 51, 48, 48, 0, 0, 2, 0, 2, 0, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0]", "Thumbnail Compression": "JPEG (old-style)", "Thumbnail Make": "SONY", "Thumbnail Model": "DSC-T7", "Thumbnail Orientation": "Horizontal (normal)", "Thumbnail XResolution": "72", "Thumbnail YResolution": "72", "Thumbnail ResolutionUnit": "Pixels/Inch", "Thumbnail DateTime": "2008:12:15 23:53:50", "Thumbnail JPEGInterchangeFormat": "2484", "Thumbnail JPEGInterchangeFormatLength": "8866", "EXIF ExposureTime": "1/40", "EXIF FNumber": "7/2", "EXIF ExposureProgram": "Program Normal", "EXIF ISOSpeedRatings": "64", "EXIF ExifVersion": "0220", "EXIF DateTimeOriginal": "2008:12:15 23:53:50", "EXIF DateTimeDigitized": "2008:12:15 23:53:50", "EXIF ComponentsConfiguration": "YCbCr", "EXIF CompressedBitsPerPixel": "8", "EXIF ExposureBiasValue": "0", "EXIF MaxApertureValue": "29/8", "EXIF MeteringMode": "Pattern", "EXIF LightSource": "Unknown", "EXIF Flash": "Flash fired, compulsory flash mode, return light detected", "EXIF FocalLength": "633/100", "EXIF FlashPixVersion": "0100", "EXIF ColorSpace": "sRGB", "EXIF ExifImageWidth": "2048", "EXIF ExifImageLength": "1536", "Interoperability InteroperabilityIndex": "R98", "Interoperability InteroperabilityVersion": "[48, 49, 48, 48]", "EXIF InteroperabilityOffset": "2278", "EXIF FileSource": "Digital Camera", "EXIF SceneType": "Directly Photographed", "EXIF CustomRendered": "Normal", "EXIF ExposureMode": "Auto Exposure", "EXIF WhiteBalance": "Auto", "EXIF SceneCaptureType": "Standard", "EXIF Contrast": "Normal", "EXIF Saturation": "Normal", "EXIF Sharpness": "Normal"}