Physics Stack Exchange is a question and answer site for active researchers, academics and students of physics. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

enter image description here

My workplace uses these things to generate one-time passwords which only work within a short time period. I have always been curious about how the clock synchronisation between the authentication server and the token might work. I'm not sure whether there is any communication between the token and the outside world at all, but I would doubt it because they are small, light, and they must make these things to be as cheap as possible for lowest unit cost. So, maybe there isn't any synchronization at all? But then, wouldn't the clocks gradually drift apart, especially if the battery was running down, eventually resulting in a bricked token?

share|cite|improve this question
up vote 5 down vote accepted

The authentication server keeps track of the clock drift in each token and adjusts its expected code calculations based on that. See; search for "clock drift".

share|cite|improve this answer
Sounds like you could mess up the server's idea of your token's clock drift by waiting a while before entering your code, or entering one you generated a few minutes ago. I don't think that's exploitable, though. – Keith Thompson Dec 9 '12 at 0:02

There generally isn't any synchronisation at all.

The specific RSA unit changes once per minute but allows the next 2 or 3 pass codes to be accepted by the server as well - so as long as the token is within a few minutes of correct time it will work.

A quartz clock should lose less than a minute/year and the battery (or system upgrades) normally limit the life of these things to 3 years anyway.

share|cite|improve this answer
Yes, there isn't any automatic synchronization. When mine lost sync with our server, I had to phone IT department to "manually" sync it again. – twistor59 Dec 8 '11 at 9:33
My quartz wristwatch is fast by about 0.65 s/month, so I guess achieving an accuracy of 5 s/month should be really easy. – Edgar Bonet Dec 8 '11 at 15:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.