RSA SecurID Two Factor Authentication Guide

RSA SecurID Two Factor Authentication Guide | Generated by AI

Home 2026.02

Question: Provide a comprehensive introduction to RSA SecurID token.

Answer:

RSA SecurID (often called RSA SecurID or just SecurID) is one of the most widely recognized two-factor authentication (2FA) systems, originally developed by RSA Security (later acquired by EMC, then Dell, and now operating under RSA as part of the broader identity portfolio).

It provides strong authentication by combining something you know (a PIN or password) with something you have (a physical token or software authenticator).

Core Concept

The system generates time-based one-time codes (tokencodes) that change periodically — most commonly every 60 seconds, though some implementations use 30 seconds.

This is a classic example of a Time-based One-Time Password (TOTP)-like mechanism, but RSA uses its own proprietary algorithm (historically based on a symmetric key operation, now often AES-based in newer versions).

Main Components

The Token / Authenticator
- Hardware tokens — Small key-fob style devices (e.g., SID700, SID800 series) with:
  - LCD display showing a 6-digit (sometimes 8-digit) code
  - Countdown dots/bars showing time left until next code
  - Some models include USB connectors or smart-card interfaces for certificate storage
  - No buttons needed — code is always visible
  - Battery life typically 3–5 years
- Software tokens (soft tokens)
  - Mobile app (iOS / Android)
  - Desktop application (Windows / macOS)
  - Requires user to enter PIN inside the app in some implementations, producing an 8-digit passcode
- On-demand / delivery tokens
  - Tokencode sent via SMS, email, or voice call (no physical/software token provisioning required)
RSA Authentication Manager (formerly ACE/Server)
- Server-side software (on-premises) or cloud service
- Stores a database of every token’s unique serial number and secret seed (128-bit symmetric key)
- Contains the same time source and algorithm as the token
- Generates the expected code for each token at any moment
- Handles time drift compensation (tokens can drift slightly due to cheap internal clocks)
Authentication Flow (classic example)
- User attempts to log in to VPN, server, cloud app, etc.
- System prompts for username + passcode
- Passcode = PIN (4–8 digits, user-chosen) + tokencode (6 digits from token)
  - Example: PIN = 1234, token shows 567890 → user enters 1234567890
- Some implementations (especially soft tokens) combine them differently or require only the tokencode after PIN entry in the app.
- Authentication Agent (on target system) forwards credentials to Authentication Manager
- Server computes expected tokencode → compares → grants/denies access

Security Properties

Seed is unique per token and never leaves factory/server
Code changes every 60 seconds → captured code becomes useless quickly
Even if PIN is stolen, attacker needs physical/soft token possession
Server allows small time window (±1 interval) to account for clock drift and user delay

Advantages

Very simple user experience (just read & type number)
Works offline (no internet needed on token side)
Proven in high-security environments for decades (banks, government, defense, tech companies)
Broad integration (VPNs, RDP, SSH, cloud services via RADIUS, SAML, etc.)

Limitations & Evolution

Hardware tokens can be lost/stolen (though seed compromise is hard)
Vulnerable to real-time phishing (attacker relays code immediately)
Older deployments suffered from poor time sync or seed leakage incidents (notably 2011 RSA breach via phishing → seed compromise concerns)
Modern alternatives (push notifications, biometrics, FIDO/WebAuthn, authenticator apps like Microsoft Authenticator / Google Authenticator) often preferred for convenience
RSA has expanded SecurID into broader SecurID Access / SecurID Suite with push, biometrics, risk-based auth, cloud options

As of 2026, RSA SecurID remains widely deployed in enterprises (especially legacy/on-premises environments), though many organizations have supplemented or replaced pure token usage with modern MFA methods.

References:

Back Donate