I have just found an old RSA SecurID token, model SD600, at the back of a drawer. I only have the token - no documentation or pin numbers (long forgotten) or anything else.


Is it possible to make use of this with Linux without having anything except for the token ?

I have found stoken and installed it on my Arch Linux system. I tried to set that up using the 8-digit number on the back of the token but I get an error:

$ stoken import --token=12345678
error: --token string is garbled: General failure

I notice the token also has an date printed on it of 2010 so it is quite old.

Should this work, has the token expired or am I doing something wrong?

  • The ones I used to use also had a custom prefix (or suffix?) that was user-generated that had to be used in addition to the ever-changing code on the screen, so I'm going to go with "it's useless". – Jeff Schaller Jun 20 '17 at 23:49

The point of this kind of token is that they contain a secret value, and calculate and display a series of values from this secret value such that the only way to predict what the token will display is to actually make the token display it. It's impossible to reconstruct the secret value from the displayed values.

For the token to be useful, a server somewhere has to have a copy of the secret value. The server makes the same calculation as the token (from the secret value, and either a counter or the time). The server requires the user to enter the value that should be currently displayed on the token, which proves that the user has the token in their possession.

If you don't know what the secret value, the token is useless. And the token is designed to keep the value secret, so if you haven't saved it from somewhere, you aren't going to be able to extract it from the token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.