Token authentication system

An apparatus, method and program product for enabling token authentication by generating a secret key using manufacturer controlled information (57) present on a token (34). A computer (30) typically reads the manufacturer controlled information and applies an cryptographic algorithm (41) to determine the secret key (47). The secret key (47) may comprise or be used to generate a one-time password (42) for use in authenticating the token (34). Typical manufacturer controlled information (57) present on the token (34) includes static, non-writeable/erasable information, such as a serial number (56) or manufacturer ID (54). Where desired, the token authentication is accomplished in the absence of memory or processors on the token that are dedicated to the authentication process, itself. This absence reduces token hardware requirements and associated expenses. The dynamic generation of the cryptographic key (47) also reduces risks conventionally associated with duplicating static keys stored within token memory. Where desired, token includes a password (55) and/or a user name (53) in addition to the manufacturer controlled information (57) for realizing multiple factor authentication. As such, the password (55) and user name (53) stored on the token (34) may automatically be transmitted to the access device (14).