Subject: [http-auth] (request) some terminologies on authentication credentials

From: Yutaka OIWA <[email-masked]>
Date: Tue, 04 Oct 2011 18:34:52 +0900

Dear http-auth list members,

I am currently working on revising http-auth-problem-statement draft,
and I have a favor to ask for possible terminology suggestions.

In authentication protocols (especially those implemented on multi-layer
protocol stacks), there is several kinds of manipulated passwords going on
wire.  I have no clearly indicating terms for the following 2 cases.

In this text, I use the term "raw passwords" for the passwords that users type
in, for example "ThisIsAPassword".  It is often called "plain", "cleartext",
"unencrypted", or "plaintext" passwords.

(1)
In usual Basic authentication on plain HTTP or SASL PLAIN authentication, the
raw password is sent as "cleartext" on-wire (forget about BASE64 now).  In this
case, the term "cleartext password" gives no confusion.

However, if we use Basic on HTTPS, the "raw password" is delivered as is
to the peer server, on an encrypted channel.  The raw password is not available
to any eavesdroppers, but the receiving peer has direct access to it, and can
be reused if it is malicious.  I always feel yuck on "encrypted plaintext (or
cleartext) password", but "a plaintext password on an encrypted channel" is
still long and complex and confusing.  Any ideas?

(2)
In APOP, a raw password is used in the following way.
Let H be some kind of hash function.
  1) S->C: challenge
  2) C->S: H(challenge | password)
The server computes the same H(challenge | password) using the copy of raw
password stored in the server-side user database to authenticate.  In this way,
the server has to have a copy of raw passwords. Without having it the server
cannot perform the password checking.

In HTTP Digest auth., a raw password is used in a slightly different way.
After greatly simplified, it is equivalent to the following:
  1) S->C: challenge
  2) C->S: H(challenge | H(password))
In this case, the server-side database has to have H(password) for
authentication.  This is not a "raw password", obviously.
However, carefully observing the protocol, you will find that, if an attacker
knows H(password), it can perform an authentication trial as a client without
knowing the raw password itself.

By comparing the above two protocol flows, H(password) in the latter case
serves the role of "raw password" in the former one.  This is very different
from the nature of "hashed password" used in server-side for Basic/plaintext
authentication.

The problem I hit is how to describe the nature of this "H(password)" in a
compact form.  In the -00 draft I used the term "raw credential" and tried to
describe the nature different from the usual "hashed password", but it is still
very non-intuitive unclear.  If you have a good idea or previous knowledge,
please let me know.

-- 
Yutaka OIWA, Ph.D.                                       Research Scientist
                            Research Center for Information Security (RCIS)
    National Institute of Advanced Industrial Science and Technology (AIST)
                      Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[995DD3E1] fp[3C21 17D0 D953 77D3 02D7 4FEC 4754 40C1 995D D3E1]

---

From: Marsh Ray <[email-masked]>
Date: Tue, 04 Oct 2011 11:12:17 -0500

> still long and complex and confusing.  Any ideas?

"Plaintext password over an encrypted channel" is the best way I have 
found to describe this. I think it feels a bit yucky because it *is* a 
bit yucky. :-) Since the password credential is not bound to the 
channel, it's not the same as actual strong mutual authentication. 
Having a nicer term for this scheme might make it seem nicer than it 
really is!

>[...]

I like the term "password equivalent" for that type of thing. Perhaps 
you could call it a "password equivalent hash value" or something like that.

- Marsh