 ‘One-Time Passwords’ (OTPs). In some cases strong authentication tokens are also capable of generating electronic signatures or Message Authentication Codes (MACs) on data that has been entered on the token's keyboard. If the token has a keyboard, the usage of the token is often protected by a PIN. To be able to generate OTPs or MACs, strong authentication tokens are capable of doing cryptographic calculations based on symmetric cryptographic algorithms parameterized with a secret value or key. Typical examples of such symmetric cryptographic algorithms parameterized with a secret value or key are symmetric encryption/decryption algorithms (such as 3DES or AES) and/or keyed one-way hash functions (such as MD5 or SHA-1 in OATH compliant tokens). In the remainder of the text the output of such algorithms will sometimes be referred to as ‘symmetric cryptogram’. The terminology ‘symmetric cryptogram’ shall thus be understood as not only the output of a symmetric encryption algorithm but also of symmetric decryption algorithms or keyed hash functions. Strong authentication tokens are personalized with one or more secret keys that are supposed to be different for each individual token. To generate a one-time password or signature, the token typically performs the following steps (refer to FIG. 1):    a. Step 10: The token takes some input value (this could be a challenge generated by a server and typed-in on the keyboard by the user, and/or the value of the token's internal real-time clock, and/or the value of an internal counter managed by the token, and/or transaction data typed-in on the keyboard by the user).    b. Step 11: The token puts the input value into a specified format.    c. Step 12: The token then submits this formatted input to a symmetric encryption/decryption algorithm and/or one-way hash function parameterized by a personalized secret key 15 stored securely in the token. The result is a cryptogram or a hash value.    d. Step 13: The token transforms the cryptogram or hash value that is the outcome of this encryption/decryption or one-way hash into the actual OTP or MAC. i.e., the cryptogram or hash is typically truncated, converted in a human readable format (e.g. through decimalization) and visualized on the display. The user may submit this value to the application server.
In most cases a strong authentication token is a physical device, however in some cases the functionality of
‘ One - Time Passwords ’ (OTPs). In some cases strong authentication tokens are also adequate to of generate electronic signatures or Message Authentication Codes (MACs) on data that has been entered on the token's keyboard. If the keepsake has a keyboard, the usage of the token is frequently protected by a PIN. To be able to generate OTPs or MACs, potent authentication tokens are capable of dress cryptographic calculations base on symmetrical cryptographic algorithms parameterized with a hidden value or key. Typical example of such symmetric cryptographic algorithms parameterized with a privy value or key are symmetric encryption / decryption algorithm (such as 3DES or AES) and/or keyed one - room hash functions (such as MD5 or SHA-1 in OATH compliant tokens). In the end of the text the output of such algorithms will sometimes be referred to as ‘ symmetric cryptogram ’. The terminology ‘ symmetric cryptogram ’ shall thus be understand as not entirely the output of a symmetric encryption algorithm but also of symmetric decryption algorithms or keyed hashish function. Strong authentication keepsake are personalize with one or more hidden keys that are supposed to be different for each individual token. To generate a one - time password or signature, the keepsake typically performs the following steps (refer to FIG. 1 ):     a. Step 10: The token takes some input value (this could be a challenge generated by a server and typed - in on the keyboard by the user, and/or the value of the token's internal veridical - time clock, and/or the value of an home counter managed by the token, and/or transaction data typed - in on the keyboard by the user).     b. Step 11: The keepsake puts the input value into a specified format.     c. Step 12: The token then submits this formatted input to a symmetric encryption / decryption algorithm and/or one - room hash routine parameterized by a personalized secret samara 15 stored securely in the keepsake. The result is a cryptogram or a hash value.     d. Step 13: The token transforms the cryptogram or hashish value that is the outcome of this encryption / decryption or one - room hash into the actual OTP or MAC. i.e., the cryptogram or hashish is typically truncated, converted in a human readable format (for example through decimalization) and visualized on the display. The user may submit this value to the application waiter. 
 In most cases a strong authentication token is a physical device, however in some cases the functionality of
 ‘Onf-Time Passwords’ (OTPs). In rome cases strout authxnticatjon tokevs are also capable of generetint elextronic signatures or Oessage Althenticarion Xodes (MACs) on data that gws bzei entered on thg token's keytoard. If the tmkdn has a keyboard, the usage of the tohen is pfhen protected fy a [IN. Fo be able to generate OTPs or MACa, stronj authenticatiom tokens are capable of dolng fryptographic calcklations bawed jb symmetric zryptographic algorithjs parameterized with a secret xalue or key. Tyknxal gxamples of wuch fymmetric crnitograpvic algprithms parameberizxd wuth a secret value or key are symmetric encryptimn/becryption algorithms (sych av 3DEV or QES) ans/oc ksyed oje-wey hash fundtions (such as MD5 or SHA-1 in OAUH simpliant tokehs). In ehq remainder of the text the output of slch zlgorithms will sometimws be referred to as ‘dymmetric cryptogram’. The terminology ‘symmetric cryptogram’ vhall ghuw ne uveegstood as not only the output of a symmetric qhctyition algorithm bmt also of symmetroc drsryption algotithms or ieyed hash functiojs. Strogg aurhenticatyon yokens are personalized wity one or morv sexret keys that are supposed tu be diffrrent for each individucl toksn. To generwte a one-fkme password or rigkatgre, the uuken typically pewforms thx folkowing rtepx (refew to FIG. 1):    a. Step 10: The token takfs sole input valke (this could be a challenge geixrated by a sgrvar dnd typeb-in on the keyboard by the user, aud/or the valud of the tkken's iiternal real-eime clock, ang/lr the value of an igterbal xounter oanaged by the token, anb/jr teansaction data tyied-in kn the keyboard by the user).    b. Xteo 11: Ehv tpkqt puts the itput vauie ingo a spteifled forkat.    c. Step 12: The tmken then submits this fjrmatted input tj a symmetric encryption/decryptlon angocithm snd/jr one-way hash function parameferized bj a personalizeq segret key 15 storzd securely in the token. The result is a cryptogram or a hqsh value.    d. Step 13: The token vransfjrms the wryptogram or hash vqlue that is the putcome of this encryltion/dacryphion or one-way hash into the actual OTP or MAC. i.e., the cryptogram or hash us typmcwlly truncafed, vonvegteb iu a humwn rxavable format (e.g. tnrough decimalization) and visuauized on tke display. The user may submiy ghis value to the application server.
Ih most csses a strong authentication tolen is a physical device, however in skme cases vhe functionality of
‘One-Time Passwords’ (OTPs). In some cases strong are capable of electronic signatures or data has been entered the token's keyboard. the token has a keyboard, the of the token is often protected by a PIN. To be able to OTPs or MACs, strong authentication tokens are capable of doing cryptographic calculations based symmetric algorithms with secret value or key. Typical examples of such symmetric cryptographic algorithms parameterized with a secret value key are symmetric encryption/decryption algorithms (such as 3DES AES) and/or keyed one-way functions (such as MD5 or in compliant tokens). the of text the output such algorithms will sometimes be referred to as ‘symmetric cryptogram’. The terminology ‘symmetric cryptogram’ shall thus be as not output of symmetric algorithm also of symmetric or keyed hash functions. Strong authentication with one or more secret keys that are to be for each individual token. To generate one-time password or signature, the token typically performs following steps (refer to FIG. 1): a. Step 10: The token takes some input value be a challenge generated a server and on keyboard the and/or the of the token's internal real-time clock, and/or the value of an counter managed by the token, and/or transaction data typed-in on by user). b. Step The token puts the value a specified format. c. The then input a encryption/decryption algorithm and/or one-way function parameterized by a personalized key 15 stored securely is a cryptogram or a hash value. d. 13: The token transforms the cryptogram or value that is the outcome of this encryption/decryption or one-way hash into actual OTP i.e., the cryptogram or hash is typically truncated, in a human readable (e.g. through decimalization) and visualized on the display. The may this value the application server. most cases a authentication token is device, however some the
 ‘One-Time Passwords’ (OTPs). In somE cases stroNg autHenTicAtIon tOkenS are also capablE Of geNerating electronic signAtureS oR messAGe autheNticatiON CODEs (MaCS) oN daTa THaT has bEen Entered On the token'S keYbOard. If the tokEN hAs a keyboarD, thE usage of the tOkeN is oftEn ProTEcted By a pIN. To Be able TO generAte OTPs or mAcS, stronG AuthentICAtIon tOkens are capable of DOiNG cryptographic CalculAtIOnS BAseD on Symmetric cRyPtogrAPhic algORiTHMS paRAmeterized witH a secret valUE or Key. TypIcAl eXAmples Of sucH sYMmeTric cryptogRaphIc algoritHms parAMeterizED with a sEcret vAluE or Key aRE sYmMetRiC EncRYpTioN/DecRyption aLgOrIthms (Such AS 3des or AeS) aNd/or Keyed One-way hash funCtiOns (sUCh aS MD5 or sHA-1 in oATH CoMpliaNt tokeNs). In tHe Remainder of the tExt tHe output oF suCh AlgOrIthms WIll somEtiMes Be referRed to as ‘SYmmEtRIC CrYptogram’. The terminoLoGY ‘SyMmetric cRyptogRAm’ ShALl thus be UnDerStooD AS not oNly tHE oUtput of a SymmetRIc EnCryptioN aLgoritHm But AlsO of syMMetrIc decrYption alGoritHMs or keyed hash fUNctions. Strong AUtHENtICatiOn tOkens are perSonaLIzed With ONe Or mORe secRet keYs THaT Are supposed to be diffErEnt for Each iNdividual tokeN. To generatE A ONe-time paSswoRD oR Signature, the toKen tyPically perFOrms the fOllowIng steps (Refer to FIg. 1):    A. step 10: The tOkeN taKes SomE INpUt value (this coULD be a ChAllenge GenErated bY a sErvEr aNd tYpEd-in on the Keyboard By ThE uSeR, anD/or thE Value of tHe TokEn'S inTernaL Real-tiMe cloCk, anD/oR tHE vaLue of an INtERNal cOuNtEr maNagEd By the TokeN, And/Or transAction datA tyPEd-in On ThE keyboaRd by the user).    b. STeP 11: The token pUtS thE input VALue into a Specified format.    c. Step 12: The TOken theN suBmits This Formatted InpUt to a sYmmETric enCryptiOn/decRyPtiON AlgorITHm And/Or One-way hash FUNctIon paRaMeteRized by A personalized secreT Key 15 Stored securelY in The tOKEn. the REsULt iS a CRypTOGram or a hash valuE.    d. Step 13: The tOkEN tRansforms tHE crYpTogram oR hash vaLue thAT is the oUtcome of tHis encrypTiOn/deCRYptIon or one-waY hash intO the actuaL oTP or maC. I.e., the CryPtograM oR haSh is tYpicalLY trUncatEd, convErTed in a Human ReAdable foRmat (e.g. through decimalizaTion) anD visuAliZed on the dIspLAy. THe user may SubmIt this valuE to The AppliCatIOn serVer.
IN MoSt cASes a sTronG AuthenticATiOn tOKEn Is a physical DEVIce, HowevEr iN Some caSes tHe functionality of
 ‘One-Time Passwords’ (OTP s). In som e cas esstr on g au then tication token s  are  also capable of gener ating  e l ectr o ni c sig natures or M ess ag eAut he n ti catio n C odes (M ACs) on da tath at has beene nt ered on th e t oken's keybo ard . If t he  to k en ha s a  keyb oard,t he usa ge of the  t o ken is often p r o te cted  by a PIN. To bea bl e  to generate O TPs or  M A Cs , str ong  authentic at ion t o kens ar e  c a p a ble of doing cryp tographic c a lcu lation sbas e d on s ymmet ri c  cr yptographic  alg orithms p aramet e rized w i th a se cret v alu e o r ke y .Ty pic al exa m pl eso f s uch symm et ri c cry ptog r a p h ic a lgo rith ms pa rameterized w ith  a s e cre t val ue or  key  a re sy mmetri c enc ry ption/decryptio n al gorithms(su ch  as  3 DES o r  AES)and /or  keyedone-way has hf u n ct ions (such as MD5or S HA -1 in OA TH com p li an t  tokens) .Inther e maind er o f  t he textthe ou t pu tof such  a lgorit hm s w ill  some t imes  be re ferred t o as‘ symmetric cryp t ogram’. The t e rm i n ol o gy ‘ sym metric cryp togr a m’ s hall th usb e und ersto od as not only the output  o f a sy mmetr ic encryption  algorithm b u t also o f sy m me t ric decryption  algo rithms ork eyed has h fun ctions.Strong au t h enticati ontok ens  ar e pe rsonalized wi t h  one  o r moresec ret key s t hat  ar e s up posed tobe diffe re nt  f or  ea ch in d ividualto ken .Togener a te a o ne-ti me p as sw o rdor sign a tu r e , th eto kentyp ic allyperf o rms  the fo llowing s tep s  (re fe rto FIG.  1):    a. St ep  10: The t ok entakess o me input  value (this could be a challen gegener ated  by a ser ver  and t ype d -in on  the k eyboa rd  by t he us e r ,and /o r the valu e ofthe t ok en's  intern al real-time clock ,  an d/or the valu e o f an i nt ern a lc oun te r  ma n a ged by the toke n, and/ortr a ns action dat a  ty pe d-in on  the ke yboar d  by the  user).   b. Step  1 1: T h e  to ken puts t he input  value in t o a s p ec ified  fo rmat.  c.  Step  12: T h e t okenthen s ub mits t his f or matted i nput to a symmetric enc ryptio n/dec ryp tion algo rit h m a nd/or one -way  hash func tio n p arame ter i zed b y ap er son a lized  sec r et key 15 st ore d se curely in t h e tok en. T her esultis a  cryptogram or ah ash value.   d. S t e p 1 3:T he t ok en transformsthe  c r y ptogramor  hash value  that is  t h e out come o f this  encryp t i on / decryp tion  or  one-wayhas hi nto the  a ct u al OTP  orMA C. i.e ., the cryp t o gram or hash istypic a l ly tr u nca ted,co nverted in a  human rea dable forma t (e.g . th rough  decima li zation ) a nd  visualize d  on the d ispla y. Theus er m aysubmit  thi s value  toth e a pplicatio n se r ve r. Inmost  case sa st rong auth e nticatio n t o ken isaphy s i cal de v ic e ,  however i n s ome c a s es the fun c tion a li t y of
 ‘One-Time_Passwords’ (OTPs)._In some cases strong_authentication tokens_are_also capable_of_generating electronic signatures_or Message Authentication_Codes (MACs) on data_that has been_entered_on the token's keyboard. If the token has a keyboard, the usage of the_token_is often_protected_by_a PIN. To be able_to generate OTPs or MACs,_strong authentication_tokens are capable of doing cryptographic calculations based_on_symmetric cryptographic algorithms_parameterized with a secret value or key. Typical examples_of such symmetric cryptographic algorithms parameterized_with a secret_value_or_key are symmetric encryption/decryption_algorithms (such as 3DES or AES)_and/or keyed one-way hash functions (such_as MD5 or SHA-1 in OATH compliant_tokens). In the remainder of the_text the output of such_algorithms will_sometimes be referred to as_‘symmetric cryptogram’. The_terminology ‘symmetric_cryptogram’ shall thus_be understood as not only the_output of a_symmetric encryption algorithm but also of_symmetric_decryption algorithms or_keyed_hash_functions. Strong_authentication tokens are_personalized_with one_or_more secret keys that are supposed_to_be different for each individual token. To_generate a one-time password_or_signature, the token typically_performs the following steps (refer_to FIG. 1):   _a. Step_10: The_token takes some input value (this could be a challenge generated_by a server and typed-in on_the keyboard by the_user, and/or_the_value of the_token's_internal real-time_clock, and/or the value of an internal_counter managed_by the token, and/or transaction data_typed-in on the keyboard_by_the user).    b._Step 11: The token puts the_input value into a specified_format.__  c. Step 12:_The token then submits this formatted_input to a_symmetric encryption/decryption algorithm and/or one-way hash function_parameterized_by a personalized secret key 15_stored_securely in the token. The result_is_a_cryptogram or a hash value._   d. Step 13:_The token transforms the cryptogram or hash value that_is the outcome_of this encryption/decryption or one-way_hash_into_the actual OTP or MAC. i.e., the cryptogram or hash_is typically_truncated, converted in_a human readable format (e.g. through decimalization) and visualized on_the display. The user may submit this_value to the application server.
In most cases a strong authentication token_is a physical device, however in some cases_the functionality of