Seeking software capable of cracking an RSA SecurID, Nick Kavadias wrote: "I remember reading that the algorithm for the key generation had been broken & that there was a software utility available, where if you punched in enough sequences from your physical key it would figure out the key sequence. Where can i get this software???"
Since 2003, the RSA SecurID has been based on AES block cipher, the US advanced crypto standard. The SecurID uses a 128-bit token-specific secret key, and AES, to continuously generate a series of 60-second SecurID token-codes by encrypting:
- a 64-bit standard ISO representation of Current Time
- a 32-bit token-specific salt (the serial number of the token), and
- another 32 bits of padding.
Sorry, Nick. No joy. No one is likely to "break" AES in the foreseeable future.
The original SecurID, first introduced in 1987, used a proprietary John Brainard algorithm to hash a 64-bit token-specific secret and Current Time to generate the SecurID's series of 6-8 digit token-codes, continuously changing every 60 seconds.
Although, to the best of my knowledge, no one ever successfully cracked one of the classic 64-bit SecurID, there was a fascinating burst of academic insight into new types of vulnerabilities in the old SecurID hash has that was published shortly after RSA upgraded to its AES SecurID. These theoretical attacks on the Brainard hash typically entailed the collection of many thousands of SecurID token codes and an extensive statistical analysis of the series that might be effective, on some tokens. I know of several attempts to use this approach to actually crack a SecurID, but they were all unsuccessful
I doubt if there is actual software out there -- and it would be, after all, only good for attacking the 64-bit SecurID, a product no longer in use -- but there academic papers available that explore the probabilities, if that is your bent. (The most insightful deconstructions and analysis of the Brainard hash were in a 2003 paper by Biryukov, Lano, and Preneel and another paper published in 2004 by Contini and Yin, two former RSA cryptographers. I think both are readily accessible online.)
I'm a little unclear about your goal here, Nick. RSA has freely distributed millions of software versions of the AES SecurID, customized for various hand-held platforms, from their website. They charge for their server and the "secret keys" used to initialize these token emulation applications. There are, doubtless, various reverse engineered versions of the SecurID code in circulation. So you can play with real or imitation SecurID code -- but without the 128-bit secrets make the RSA system work. And RSA's authentication server will only register and support SecurID secret "keys" which have been digitally signed by corporate RSA.
I hope this answers your questions. Speak up if you have more. I've been a consultant to RSA for many years, and my bias is overt, but I'm usually up for Q&As.