Subject: RE: PPTP AUTHENTICATION

From: Vernon Schryver <[email-masked]>
Date: Thu, 17 Jun 1999 15:36:25 -0600 (MDT)

> From: Gurdeep Singh Pall <[email-masked]>

> You are not mistaken. On the wire CHAP and MS-CHAP are equivalent in that
> both produce a response that is a fucntion of the secret and the challenge. 
>
> As far as stored "secrets" are concerned there is no claim that storing
> "user password" is significantly worse than storing its one-way-hash if both
> are treated as "first order" secrets (as in CHAP or MS-CHAP). But this isnt
> the first time on the ppp list that non-issues have been debated ad nauseam
> :-)

It seeems I've been foolishly wrong.  By actually breaking down
and reading RFC 2433, I see that it is essentially CHAP, but with
a form of DES instead of MD5 for the hashing in the challenges and
responses.  MS-CHAP is not PAP.  I appologize for saying it was.

However, both common wisdom and the cleartext passwords for file
sharing on LANs make the password changing features of RFC 2433
and using the same password for user authentication as network
access a Bad Idea(tm).

Also, the following recently mentioned text in section 2 of RFC 2433 is
still wrong and misleading, since the password that matters is the 56-bit
DES key.
                                        The MS-CHAP format does not
        require the authenticator to store a clear-text or reversibly
        encrypted password.

That the user is allowed to type a memorable ASCII string instead of (for
example) 14 hex digits is a good user-interface choice, but does not keep
the key from being stored in the clear.  Of necessity, and contrary to
those words, the key is always stored as "clear-text or reversibly
encrypted."

Vernon Schryver    [email-masked]

---

From: "Karl Fox" <[email-masked]>
Date: Thu, 17 Jun 1999 17:44:01 -0400

>responses.  MS-CHAP is not PAP.  I appologize for saying it was.

First off, let me admit that the following paragraph is based on my rather 
poor memory of an analysis I did more than four years ago.

One important difference is that DES is used in a way that may make it 
easier than necessary to break.  It is used to encrypt three blocks without 
cipher block chaining, and one of the blocks is padded with 6 bytes of 
zeros, meaning you only have 16 bits of plaintext space to search.  This may 
or may not make it easier to break the entire encrypted sequence.

Karl Fox <[email-masked]>
Key fingerprint = 5B15 7260 D55E D680 0B93  4953 8A3B AB0E C05D 77A3

---

From: Archie Cobbs <[email-masked]>
Date: Thu, 17 Jun 1999 17:05:41 -0700 (PDT)

Regarding PPTP security weaknesses, some of you may find this paper
interesting if you haven't read it already.

  "Cryptanalysis of Microsoft's Point-to-Point Tunneling Protocol (PPTP)"

  http://www.counterpane.com/pptp.html

-Archie

___________________________________________________________________________
Archie Cobbs   *   Whistle Communications, Inc.  *   http://www.whistle.com