Subject: Important of Good Server Nonces in Digest

From: Randall Gellens <[email-masked]>
Date: Tue, 9 Jul 2002 18:06:47 -0700

Can someone explain the importance of good server nonces in the 
DIGEST mechanism?  Assuming the client will be selecting a good 
client nonce (say, 128 bits of entropy from physical sources), what 
are the risks of the server nonce being simply a 32-bit timestamp (or 
an MD5 hash of a 32-bit timestamp)?

---

From: "Paul Leach" <[email-masked]>
Date: Mon, 22 Jul 2002 14:36:23 -0700

TIme-based nonces allow an attacker to predict the future value of a
nonce, and attack the protocol for that value of the nonce (or ones
nearby).
 
It's easy enough to make them unpredictable: MD5(time,
host-specific-secret).

-----Original Message-----
From: Laurence Lundblade [mailto:[email-masked]] 
Sent: Monday, July 22, 2002 1:59 PM
To: Lawrence Greenfield; [email-masked]; Randall Gellens
Subject: Re: Important of Good Server Nonces in Digest

At 03:28 PM 7/22/2002 -0400, Lawrence Greenfield wrote:

   Date: Tue, 9 Jul 2002 18:06:47 -0700
   From: Randall Gellens <[email-masked]>

If the server doesn't choose a good nonce (one that is unpredictable
and won't be reused) then it is vulnerable to a replay attack. (If I
can anticipate the server's nonce and I masquerade as the server to
the client and send that nonce, I'll be able to authenticate as that
client to the server when it sends that nonce.)

The client nonce is there to prevent various chosen plaintext attacks
on the client and to force the server to prove that it knows the
password.

It is important that the nonce changes with each authentication to
prevent a replay attack. Both server generated and time-based methods
fullfill this.

It is important that the client not get to pick the nonce themselves or
they could pick the same one every time. Both server generated and
time-based methods fullfill this.

In terms of attacking the client man-in-middle-style by getting it to do
the auth step on some nonce contrived to help reveal the password, I
think there's nothing that can be done about that. 

You're right that a m-i-t-m attack allows the m-i-t-m to impersonate the
client, but it's basically the same as an IP hijack attack. The only
prevention for that is digitally signing the data transferred.

It does NOT seem important that the nonce be unpredictable. The nonce is
in the clear in the first place, so it isn't secret. So even though the
time-based mode gives a predictable nonce, I don't see any problem with
it.

LL

Larry