Re: DBIS - new IETF drafts

On Fri, Jan 10, 2014 at 02:36:45PM +0000, Mark R Bannister wrote:

>    While a DUA MAY implement any authentication password scheme
>    supported by the DSA, it MUST support the CRYPT scheme for backwards
>    compatibility, which is an implementation of the traditional UNIX
>    crypt algorithm.  However, it is RECOMMENDED that a more secure
>    scheme is used.

Is it really necessary for client code to get involved with this at all?

>    Passwd and group database entries contain encrypted passwords and
>    SHOULD be transmitted securely when transferred between DSA and DUA
>    to prevent eavesdropping.  A DUA SHOULD NOT allow a user to see any
>    encrypted passwords except they MAY see the password on their own
>    posixUserAccount entry in encrypted form.

Don't rely on the DUA (client code) to protect data from the user.
That's just saying "here is a bit of paper with a secret on the
other side; please don't turn it over". The person currently looking
at the screen may not be the person who logged in...

Andrew
-- 
-----------------------------------------------------------------------
|                 From Andrew Findlay, Skills 1st Ltd                 |
| Consultant in large-scale systems, networks, and directory services |
|     http://www.skills-1st.co.uk/                +44 1628 782565     |
-----------------------------------------------------------------------