|
|
Back to:
www.javaworld.com/javaworld/jw-03-2009/jw-03-lamport-otp.html.
I found it a little hard to understand the underlying security aspects. Is the security of the algorithm based on the fact that the successor-function F is hard to reverse? So that if
A = F(B)
Then it's hard to reverse F? So that knowing A and F will not help you find B?
Secondly, is it correct that the algorithm is insufficient to establish trust? It merely verifying that a visitor is a returning user.
Finally: Is there a common way to handle it if the client runs out of keys?