If I'm understanding this correctly, then an attacker still has to know which seed is linked to my token in order to use it?
Or can they reverse engineer that if they catch sight of one number?
Edit: Spelling
Or can they reverse engineer that if they catch sight of one number?
Edit: Spelling
Sources close to RSA tell Ars that the March breach did indeed result in seeds being compromised. The algorithm is already public knowledge.
As a result, SecurID offered no defense against the hackers that broke into RSA in March. For those hackers, SecurID was rendered equivalent to basic password authentication, with all the vulnerability to keyloggers and password reuse that entails.
So they got a lot of the seeds and then were basically down to trial and error, similar to know passwords.
Using private keys stored in a hardware carried with the owner with a challenge Q&A seems more secure.
You're right that a different device S' that received a challenge c from the server and computed S'(c,s,t) could offer more security via public key crypto. But it would take more power (if communicating to the client machine to avoid user transcription of the challenge) or have a more cumbersome UI. I'll bet such devices are already sold.
One would have hoped that the LMC admins would have detected a brute force attack against their RSA servers, I guess they were already infested with keyloggers?