Subject: authmeth: passwords in the clear

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 27 Feb 2004 07:53:22 +0100

authmeth-10 says:

> 11. General Requirements for Password-based Authentication
> (...)
>   To mitigate the security risks associated with the use of passwords, 
>   a server implementation MUST implement a configuration that at the 
>   time of authentication or password modification, requires: 
>
>      1) A Start TLS encryption layer has been successfully negotiated. 
>
>       OR 
>
>      2) Some other confidentiality mechanism that protects the password 
>         value from snooping has been provided. 
>
>       OR 

This should only apply to cleartext passwords, not e.g. modifications of
attributes that contain encrypted passwords.  I suppose that can be
considered a 'confidentiality mechanism' as in (2) so this case is
covered, but confidentiality mechanisms elsewhere in the draft do not
refer to that, only to things like TLS or SASL layers.

It's not just modifications.  It's any operation which involves
passwords, e.g. compare.

Finally, as I said in the thread about this, we cannot mandate this for
other operations than bind, because a gateway server may not know which
attributes contain passwords (other than userPassword).  You could use
"MUST" protect cleartext bind passwords, and "SHOULD" protect other
cleartext passwords.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 29 Feb 2004 15:06:49 +0900

At 08:53 AM 2/28/2004, Hallvard B Furuseth wrote:
>attributes that contain encrypted passwords.

I concur that this particular section should be limited to
cleartext passwords used in authentication.  

>"MUST" protect cleartext bind passwords, and "SHOULD" protect other

I think other "uses" of cleartext passwords (such as modification)
should be address in documents detail specific mechanisms (e.g.,
LDAP Password Modify Operation) and/or password schema.  (And,
aside from some very general guidance, issues associated with
gateways, caching proxies, chaining servers, and/or replicas
should be addressed in documents discussing such these things.)

Kurt