Re: Compound authentication "issue"
Dale Gustafson <[email protected]> Fri, 20 Dec 2002 07:37:43 -0600
| Newsgroups | gmane.ietf.sacred |
|---|---|
| Message-ID | <[email protected]> |
--------------90FF6F098C393ADBE291A13E
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hi Stephen,
Stephen Farrell wrote:
> Hi Dale,
>
> I agree with all that you wrote, except for the "we" bit. I'm not
> at all sure that it'd be in our charter to develop any new mutual
> authentication schemes, which is what I believe would be needed to
> properly bind sTLS and DIGEST-MD5.
You may be right.
Here's another alternative:
SACRED clients will include a unique value received from the TLS server (e.g., during
session negotiation) within their digest-MD5 response.
For example, the TLS server's certID could be used to bind the client's digest-MD5
response to the connected TLS server and no others. I believe the client's response is
now unusable with any other credential server:
client response = Hash ((Hash(A1)), { nonce-value, ":"nc-value, ":",
cnonce-value, ":", qop-value, ":", HEX(H(A2)) }))
where,
A1 = Hash(user-name:realm:password):server-nonce:client-nonce
A2 = AUTHENTICATE:digest-uri-value:HEX(TLS-server-certID)
Would that do it?
--------------90FF6F098C393ADBE291A13E
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<tt>Hi Stephen,</tt>
<br><tt></tt> <tt></tt>
<p><tt>Stephen Farrell wrote:</tt>
<blockquote TYPE=CITE><tt>Hi Dale,</tt><tt></tt>
<p><tt>I agree with all that you wrote, except for the "we" bit. I'm not</tt>
<br><tt>at all sure that it'd be in our charter to develop any new mutual</tt>
<br><tt>authentication schemes, which is what I believe would be needed
to</tt>
<br><tt>properly bind sTLS and DIGEST-MD5.</tt></blockquote>
<tt>You may be right.</tt><tt></tt>
<p><tt>Here's another alternative:</tt><tt></tt>
<p><tt>SACRED clients will include a unique value received from the TLS
server (e.g., during session negotiation) within their digest-MD5 response.</tt><tt></tt>
<p><tt>For example, the TLS server's certID could be used to bind the client's
digest-MD5 response to the connected TLS server and no others. I
believe the client's response is now unusable with any other credential
server:</tt><tt></tt>
<p><tt>client response = Hash ((Hash(A1)), { nonce-value, ":"nc-value,
":",</tt>
<br><tt>
cnonce-value, ":", qop-value, ":", HEX(H(A2)) }))</tt><tt></tt>
<p><tt>where,</tt><tt></tt>
<p><tt> A1 = Hash(user-name:realm:password):server-nonce:client-nonce</tt><tt></tt>
<p><tt> A2 = AUTHENTICATE:digest-uri-value<font color="#FF0000">:HEX(TLS-server-certID)</font></tt><tt></tt>
<p><tt>Would that do it?</tt>
<br><tt></tt>
<br><tt></tt> </html>
--------------90FF6F098C393ADBE291A13E--