Subject: Re: Secure Remote Password interest

From: Vernon Schryver <[email-masked]>
Date: Wed, 21 Mar 2001 11:40:42 -0700 (MST)

> From: James Carlson <[email-masked]>

> ...
> There's more than one exposure here.  CHAP has the same dictionary
> guessing exposure as SRP.  If I trap a CHAP Challenge and Response
> from the wire, then I can use a dictionary attack to reveal the shared
> password used to generate that given Response from that given
> Challenge.  for (i in guesses) if MD5(id,i,chal)=response print i;
>
> At least theoretically, having multiple different Challenges and
> Responses should make this attack easier by giving additional key
> material.
>
> The random ID does no good here.
>
> SRP essentially moves this same vulnerability out to the database.
> ...

That's a quite good point in favor of SRP and against CHAP that should be
made more clear in the draft.

CHAP is vulnerable to dictionary attacks even when the bad guy does not
have access to the database.  The price of a modular exponentiation
in SRP forces dictionary attackers to get the hash database.

If I were writing the draft, I'd flog that aspect more than replacing the
CHAP cleartext database.  With reasonable operating systems, read-only
access to the CHAP cleartext database often implies write-access, and 
write-access ends the game for any authentication scheme including SRP.

Vernon Schryver    [email-masked]

---

From: James Carlson <[email-masked]>
Date: Wed, 21 Mar 2001 14:53:53 -0500 (EST)

> made more clear in the draft.

OK, I will do that.

> in SRP forces dictionary attackers to get the hash database.

I'm not sure if that's true.  I think the risk of the data on the wire
is the same as that for the database for SRP.  I'm not an expert though.

> write-access ends the game for any authentication scheme including SRP.

True, but I'd say sometimes instead.  Think of leaky web servers and
the like -- lots of things can grant read-only access.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
Second Edition now available - http://people.ne.mediaone.net/carlson/ppp

---

From: Karl Fox <[email-masked]>
Date: Tue, 27 Mar 2001 15:16:47 -0500

Consider also key servers, LDAP servers and other security servers, some of 
which also store their goodies in clear text.  There are ways of increasing 
server security outside the scope of the protocol itself.

Karl

>the like -- lots of things can grant read-only access.

Karl Fox <[email-masked]>
Key fingerprint = 4159 B4AD 339D 4E2A 255F  9CC4 9DA9 CB4B B16D E2B1