Cryptanalysis of the Alleged SecurID Hash Function

Abstract. The SecurID hash function is used for authenticating users to a corporate computer infrastructure. We analyze an alleged implementation of this hash function. The block cipher at the heart of the function can be broken in few milliseconds on a PC with 70 adaptively chosen plaintexts. We further show how to use this attack on the full hash to extract information on the secret key stored in the token if the attacker is given several months of the token output. However in this paper we do not address a broader issue of practical security of the fielded SecurID installations