include old old draft that I wrote long time ago.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23813 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
283
doc/standardisation/draft-srp.txt
Normal file
283
doc/standardisation/draft-srp.txt
Normal file
@@ -0,0 +1,283 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Network Working Group Love Hornquist Astrand
|
||||
<draft-hornquist-astrand-krb-wg-srp.txt> Stockholms universitet
|
||||
Internet-Draft December, 2003
|
||||
Expire in six months
|
||||
|
||||
Using SRP for Initial Authentication in Kerberos
|
||||
|
||||
Status of this Memo
|
||||
|
||||
ftp://ftp.rfc-editor.org/in-notes/rfc-editor/instructions2authors.txt
|
||||
|
||||
This memo provides information for the Internet community. ...
|
||||
|
||||
Copyright Notice
|
||||
|
||||
Copyright (C) The Internet Society (2003). All Rights Reserved. ...
|
||||
|
||||
|
||||
Abstract
|
||||
|
||||
This document describes how to use SRP as a preauthentication
|
||||
mechanism in Kerberos 5 [RFC1510]. This mechanism makes the initial
|
||||
ticket request and response secure against dictionary attacks on
|
||||
users passwords.
|
||||
|
||||
Introduction
|
||||
|
||||
Kerberos without preauthentication make the protocol susceptible to
|
||||
both to password dictionary attacks on initial tickets. There are
|
||||
several pre-authentication mechanisms that tries to solve and/or
|
||||
minimize this problem.
|
||||
|
||||
Encrypted time stamp have the same problem as Kerberos without
|
||||
preauthentication, opportunities of the attacker to get key material
|
||||
is only fewer. SAM require hardware token and typically, for most
|
||||
SAM types, still require the user to have a password since they don't
|
||||
provide enough key-material for Kerberos to encrypt the response
|
||||
with. PKINIT large and complicated, and like SAM often require
|
||||
hardware. Extra-tgt requires infrastructure to use, a key/bootstrap
|
||||
must be present on each host that the users are expected to use.
|
||||
|
||||
The dictionary attack can also be solved by forcing the users to
|
||||
select good password.
|
||||
|
||||
XXX Jacques' DH preauth ?
|
||||
XXX tls protected as-req
|
||||
|
||||
SRP, Secure Remote Password protocol, [RFC2945], is a password
|
||||
|
||||
|
||||
|
||||
Hornquist Astrand [Page 1]
|
||||
|
||||
Internet Draft December, 2003
|
||||
|
||||
|
||||
authentication and key-exchange protocol that can be used over
|
||||
untrusted networks. SRP is designed to be resistable to dictionary
|
||||
attacks (both by passive and active attackers).
|
||||
|
||||
Specification
|
||||
|
||||
This document is based on SRP-6.
|
||||
|
||||
XXX read and think about rfc2944 (SRP over telnet)
|
||||
|
||||
SRP + Kerberos 5 preauthentication
|
||||
|
||||
Krb-srp-cookie in the protocol to enable the server be stateless.
|
||||
|
||||
TBA KRB-SRP-PREAUTH number
|
||||
|
||||
- Client send the AS-REQ
|
||||
|
||||
- Server looks up the principal, and finds N, g, v, salt, H. Then
|
||||
the server generates the random number b and calculate B. All
|
||||
operations are performed modulus N.
|
||||
|
||||
B = 3v + g^b
|
||||
|
||||
and sends back a KRB-SRP-CHALLENGE md-data in a KRB-ERROR. If the
|
||||
server is stateless, it can store the information (encrypted) it
|
||||
needs in krb-srp-cookie.
|
||||
|
||||
- If the client chooses to use the SRP preauthentication mechanism it
|
||||
sends back KRB-SRP-CLIENT-RESPONSE. If krb-srp-cookie is present in
|
||||
KRB-SRP-CHALLENGE its copied to KRB-SRP-CLIENT-RESPONSE. The client
|
||||
generates the random number a and calculates
|
||||
|
||||
A = g^a
|
||||
S = (B - 3g^x)^(a+ux)
|
||||
M1 = H(DER(A) | DER(B) | DER(S))
|
||||
|
||||
u is H(DER(A) | DER(B)), where DER(n) is the n encoded with the
|
||||
integer tag.
|
||||
|
||||
The client then it calculates the shared key K
|
||||
|
||||
K = s-to-key-bytes(S)
|
||||
|
||||
KRB-SRP-CLIENT-RESPONSE-ENC-DATA is filled in by the client,
|
||||
encrypted with the shared key K
|
||||
|
||||
XXX should a keyed checksum just be used instead ?
|
||||
|
||||
|
||||
|
||||
Hornquist Astrand [Page 2]
|
||||
|
||||
Internet Draft December, 2003
|
||||
|
||||
|
||||
XXX does this replace the need for M1
|
||||
|
||||
- When the server receives the KRB-SRP-CLIENT-RESPONSE response it
|
||||
calculates
|
||||
|
||||
S = (Av^u)^b
|
||||
|
||||
and the shared key K,
|
||||
|
||||
K = s-to-key-bytes(S)
|
||||
|
||||
verifies the content in krb-srp-enc, and M1. If everything checks
|
||||
out ok, the server sends back the AS-REP. The key that the AS-REP is
|
||||
encrypted with is the SRP session key, K.
|
||||
|
||||
XXX Should the server send back M2 ?
|
||||
|
||||
s-to-key defined as:
|
||||
|
||||
b = DER(S)
|
||||
if length of b is even, drop first char
|
||||
b1 = H(b[0] | b[2] | b[4] | ...)
|
||||
b2 = H(b[1] | b[3] | b[5] | ...)
|
||||
K = random-to-key(b1 | b2).
|
||||
|
||||
random-to-key is the random to key function in [KCRYPTO].
|
||||
|
||||
ASN.1 specification
|
||||
|
||||
XXX Krb-Nonce
|
||||
|
||||
KERBEROS-PREAUTH-SRP DEFINITIONS ::=
|
||||
|
||||
BEGIN
|
||||
|
||||
IMPORTS Checksum, Krb-Nonce FROM krb5;
|
||||
|
||||
KRB-SRP-CHALLENGE ::= SEQUENCE {
|
||||
krb-srp-salt[0] OCTET STRING,
|
||||
krb-srp-N[1] INTEGER,
|
||||
krb-srp-g[2] INTEGER,
|
||||
krb-srp-B[3] INTEGER,
|
||||
krb-srp-hash[4] OBJECT IDENTIFIER,
|
||||
krb-srp-flags[5] INTEGER (SIZE 4),
|
||||
krb-srp-cookie[6] OCTET STRING OPTIONAL -- must include nonce ?
|
||||
}
|
||||
|
||||
-- flags: "use combined s2k + srp key" ?
|
||||
|
||||
|
||||
|
||||
Hornquist Astrand [Page 3]
|
||||
|
||||
Internet Draft December, 2003
|
||||
|
||||
|
||||
KRB-SRP-CLIENT-RESPONSE ::= SEQUENCE {
|
||||
krb-srp-A[0] INTEGER,
|
||||
krb-srp-M1[1] OCTET STRING,
|
||||
krb-srp-hash[2] OBJECT IDENTIFIER,
|
||||
krb-srp-enc[3] EncryptedData, -- bind nonce to pa
|
||||
krb-srp-cookie[4] OCTET STRING OPTIONAL
|
||||
}
|
||||
|
||||
KRB-SRP-CLIENT-RESPONSE-ENC-DATA :: SEQUENCE {
|
||||
krb-srp-checksum[0] Checksum,
|
||||
krb-srp-flags[1] INTEGER (SIZE 4),
|
||||
krb-srp-nonce[2] Krb-Nonce
|
||||
}
|
||||
|
||||
KRB-SRP-SERVER-RESPONSE ::= SEQUENCE {
|
||||
krb-srp-M2[0] OCTET STRING
|
||||
}
|
||||
|
||||
END
|
||||
|
||||
Issues
|
||||
|
||||
send group/generator by name ?
|
||||
|
||||
how to bind request to pa data ?
|
||||
|
||||
what key should be used, the key from SRP, or the compiled key from
|
||||
s2k + SRP, right now its a flag.
|
||||
|
||||
Requirements on the KDC
|
||||
|
||||
The KDC needs to know more information for each principal. At least
|
||||
the KDC needs to store:
|
||||
|
||||
N, the safe prime
|
||||
g, the generator
|
||||
v, the password verifier
|
||||
salt, that salt that the principal used to form the verifier, v
|
||||
H, hash function used to form the verifier, v
|
||||
|
||||
Also, since the KDC no longer have a list of keys, and thus an
|
||||
implicit list what encryption types the principal is allowed use, it
|
||||
needs to have a list for all the encryption types a user is allowed
|
||||
to use with SRP preauthentication mechanism.
|
||||
|
||||
Security considerations
|
||||
|
||||
SRP
|
||||
|
||||
|
||||
|
||||
Hornquist Astrand [Page 4]
|
||||
|
||||
Internet Draft December, 2003
|
||||
|
||||
|
||||
see Security considerations in Nisses SSH SRP draft.
|
||||
|
||||
Kerberos
|
||||
|
||||
Preauthentication
|
||||
|
||||
SRP preauthentication mechanism doesn't require the client to compute
|
||||
something before the server sends "expensive" cryptographic
|
||||
operations.
|
||||
|
||||
Preauthentication have the problem that the response is not
|
||||
authenticated, so a active attacker can modify that response from the
|
||||
KDC to remove SRP to have the client choose a weaker initial
|
||||
authentication method.
|
||||
|
||||
References
|
||||
|
||||
[RFC1510] Kohl, J. and Neuman, C., "The Kerberos Network
|
||||
Authentication Service (V5)", RFC 1510, September 1993.
|
||||
|
||||
[SRP] T. Wu, "The Secure Remote Password Protocol", In Proceedings of
|
||||
the 1998 ISOC Network and Distributed System Security Symposium, San
|
||||
Diego, CA, pp. 97-111.
|
||||
|
||||
[RFC2945] Wu, T, "The SRP Authentication and Key Exchange System",
|
||||
RFC2945, September 2000.
|
||||
|
||||
[KCRYPTO] Raeburn, K., "Encryption and Checksum Specifications for
|
||||
Kerberos 5", draft-ietf-krb-wg-crypto-05.txt, June, 2003. Work in
|
||||
progress.
|
||||
|
||||
Author's Address
|
||||
|
||||
Love Hornquist Astrand
|
||||
Enheten for it och media
|
||||
Stockholms universitet
|
||||
S-106 91 STOCKHOLM
|
||||
SWEDEN
|
||||
|
||||
EMail: lha@it.su.se
|
||||
|
||||
Full Copyright Statement
|
||||
|
||||
Copyright (C) The Internet Society (2003). All Rights Reserved. ...
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Hornquist Astrand [Page 5]
|
||||
|
||||
Reference in New Issue
Block a user