Forgive my ignorance but isn't the hash algorithm publicly known? Isn't "reverse engineered the SecurID token" basically have the same meaning as breaking RSA algorithm?