Subject: Re: Secure Remote Password interest

From: Vernon Schryver <[email-masked]>
Date: Tue, 20 Mar 2001 17:34:16 -0700 (MST)

> From: James Carlson <[email-masked]>

> I asked this at the working group meeting today, and I'd like to put
> it to the group at large: if there are folks out there looking at the
> EAP SRP-SHA1 draft (draft-ietf-pppext-eap-srp-01.txt) please let me
> know; either privately or on the list.
>
> I have tested an implementation based on ANU ppp-2.4.0, and I'm
> planning to release this under a BSD license (pending some document
> signatures within Sun).  This could serve as a reference
> implementation for testing purposes.
>
> I've gotten reports from the open source community that there's user
> interest, mostly because it fixes the CHAP shared secret problem.

I'm worried by that last statement and this:

                           Unlike CHAP (and variants MS-CHAPv1 [6] and
   MS-CHAPv2 [7]), access to the cleartext password is not required for
   the authenticator. 

Does that community really understand the issue, or is it only reacting
to the extremely energetic salesmanship of advocates of the various
mechanisms that improve the security of cleartext password protocols?

Is the CHAP shared secret problem worthy of attention, since in
some important sense it is neither fixable nor fixed by this protocol?

Because people consistently choose bad passphrases and because computers
have become so fast, you must treat digests of passwords as if they
were cleartext.  If the bad guys can get a copy of the authenticator's
database of verifiers, why can't they do dictionary attacks to recover
the cleartext passwords?

In other words, the warning in last paragraph of section 4 is far too
weak given what most people will infer from the claim about cleartext
passwords in the start of the draft.  Please let's not make a new mistake
like the incorrect claims about the security of MSCHAP compared to CHAP.

Vernon Schryver    [email-masked]

---

From: James Carlson <[email-masked]>
Date: Wed, 21 Mar 2001 09:26:13 -0500 (EST)

>    MS-CHAPv2 [7]), access to the cleartext password is not required for

Have you read the SRP documentation (RFC 2945)?  This is an asymmetric
system.  The mechanism described has these properties:

	- Authentication of a peer can be done using a non-invertible
          hash of the passphrase.

	- Proof of identity requires access to the original
          passphrase.

	- The hash cannot be used as proof of identity.

> mechanisms that improve the security of cleartext password protocols?

This is not a cleartext password protocol.

> some important sense it is neither fixable nor fixed by this protocol?

Please explain that statement.

The shared secret problem (at least as fixed by this protocol) is that
the authenticator must also have access to the passphrase in order to
authenticate.  This allows the authenticator to masquerade as the
authenticatee, and for common deployments invites attack of the
database that holds many shared secrets.

SRP does not have those problems.

> database of verifiers, why can't they do dictionary attacks to recover

Dictionary attacks are always possible against stolen hashes.
However, they can be made quite infeasible.  You're right that this
protocol doesn't prevent fools from choosing bad passwords.
Determined fools are hard to stop.  However, with well-chosen
passphrases, SRP is a significant set up from CHAP.

The "hash" used for SRP passphrases isn't your run-of-the-mill message
digest.  It's the result of modular exponentiation.  I expect that
it's attackable using the same methods as are used for RSA.  For long
keys, that's hard.  (On a 366MHz P-II and using a 1500 bit modulus, I
was able to try one key every 10 seconds.)

> like the incorrect claims about the security of MSCHAP compared to CHAP.

MS-CHAP's error is not comparable here.  MS-CHAP merely throws a thin
veneer of MD4 on top of a vaguely CHAP-ish protocol.  It uses this
hash as the shared secret -- neither authenticator nor authenticatee
needs access to the "user password."  The hash alone is enough to
authenticate with MS-CHAP.

SRP is different.  An authenticatee cannot use the hash alone to
authenticate.

-- 
James Carlson, Internet Engineering       <[email-masked]>
SUN Microsystems / 1 Network Drive         71.234W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.497N   Fax +1 781 442 1677
Second Edition now available - http://people.ne.mediaone.net/carlson/ppp