Subject: RE: PPTP AUTHENTICATION

From: Gurdeep Singh Pall <[email-masked]>
Date: Wed, 16 Jun 1999 19:04:23 -0700

The point (I'll spell it out this time) is that once the shared secret is
stolen (by stealing the registry, reading clear text password files, etc)
any shared secret based authentication method (CHAP, MS-CHAP) is compromised
and all bets are off. 

I agree that one-way-hashed secret is no more secure on the wire than the
secret itself since it too has the time invariant property. I dont recall
anyone claiming otherwise.

I'll have one of our security guys respond to questions re: SMBs below.

Gurdeep
-----Original Message-----
From: Vernon Schryver [mailto:[email-masked]]
Sent: Wednesday, June 16, 1999 1:18 PM
To: [email-masked]
Subject: RE: PPTP AUTHENTICATION

> From: Gurdeep Singh Pall <[email-masked]>

> So there is *no* standard protocol that supports change password. 
>
> Thanks for clarifying that you made a mistake in your somewhat loose
> comment.

As you know, his comment was not loose and he made no mistake.

> PS: your plausible attempt to show change password as a "bug" is sure to
> impress some folks. I stopped reading after the small leap "first I steal
a
> copy of MD4 hashed registry...." 

As you know, the reason why the NT designers followed UNIX and chose to
not put the cleartext version of the user's password in the registery is
that no file is secure.  You must assume that the bad guys can use any of
the familiar ways to get the contents of any particular file.  That is
why except for network things, the NT registry password scheme is
reasonably secure.

For your implication that the contents of the registery are unlike other
data and magically secure, there is also the problem of snooping for the
old clear-text passwords on any LAN running previous versions of Microsoft
software.  As far as I can tell, those clear text passwords can be hashed
by a bad guy, and then fed into MS-CHAP.  Am I wrong?  True, if I'm right,
then the bad guy would need access to a wire on the target network.  As
you know, there are few places in the world where a bad guy cannot
"social-engineer" access a LAN, and most security problems involve insiders
who start with at least access to the company intranet.

There's something related with the new "encrypted passwords" of SMB that
no one I've asked has taken the time to explain to me.  How does the new
encrypted password required for mounting a share differ from the old NT
registery hash value?  If I put a network snooper (especially any of the
many software products that run on Windows 95, Windows 98, NT, or UNIX)
on a LAN and watch shares mounted, can I use the "encrypted passwords"
what I will see?  My guess is that the so called encrypted passwords are
only a hash of user's password in the grossly insecure style of MS-CHAP,
telnet, and rlogin, and so can be replayed in the time honored fashion.
In other words, I guess that SMB ships cleartext passwords over the wire.
Is that a valid guess?  Actually, my guess is that I could use those
"encrypted passwords" with MS-CHAP, without access to the machine running
the registry or anyone noticing.  Is that the case?

If my guesses are true, what about your implication about security of the
contents of the registry?

Vernon Schryver    [email-masked]

---

From: James Carlson <[email-masked]>
Date: 17 Jun 1999 06:46:33 -0400

> any shared secret based authentication method (CHAP, MS-CHAP) is compromised

Absolutely true, at least for PPP authentication.  Of course, systems
that permit use of a *separate* shared secret for CHAP and a password
for authentication to network nodes can be more secure than those that
promiscuously use a single 'password' for all access.

> anyone claiming otherwise.

Really?  Then why does RFC 2433 say this on page 2:

      * The MS-CHAP Response packet is in a format designed for
        compatibility with Microsoft's Windows NT 3.5, 3.51 and 4.0, and
        Windows95 networking products.  The MS-CHAP format does not
        require the authenticator to store a clear-text or reversibly
        encrypted password.

In fact, MS-CHAP *does* require the authenticator to store a
"clear-text password" in exactly the same manner as standard CHAP.
That this "password," or secret, is a hard-to-remember string of bytes
produced automatically by some algorithm is completely irrelevant.

-- 
James Carlson, Software Architect                   <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp