RE: pppcn

> From: James Carlson <[email protected]>
> To: Bernard Aboba <[email protected]>

> ...
> > How is it possible to "anticipate" authentication protocols?  If this were
> > true, it would imply that the authentication algorithms were broken since
> > they are required to demonstrate pseudo-randomness.
>
> It's actually fairly easy.  All that needs to be done is guarantee
> that someone who doesn't know a shared secret cannot predict the
> 'random' portions of the message.  For example, generate a
> cryptographic hash based on a shared secret and the challenge used in
> the last session (saved in some local storage), and use that hash as
> the challenge string.

Exactly.

"Psuedo-random" does not imply "insecure."
"Predictable by the bad guy" does, but that's a quite special and in this
context undesirable subset of "psuedo-random."

For another example of predicted shared secrets, consider S/key.



> Obviously, such a trick is ineffective if the authentication mechanism
> is more obtuse than either PAP or CHAP.

Probably so, although I don't see how for any likely authentication
mechanism.


Vernon Schryver    [email protected]