Problem - Kevin Tafuro

Chapter CHAPTER 8 8
Authentication and Key Exchange
At first glance, it may not be clear that authentication and key exchange are two topics
that go together. But they do. This chapter is really all about secure connection
establishment—everything the client and server need to do before they start talking.
Generally, the server will need to authenticate the client; the client will need to make
sure the server is the correct machine (not some attacker). Then the two parties will
need to come to some agreement on how to communicate securely beyond that, also
agreeing on an encryption key (or a set of keys).
Yes, authentication doesn’t always happen over an insecure network connection—it
is certainly possible to authenticate over a console or some other medium where network
attacks pose little to no risk. In the real world, however, it’s rare that one can
assume a secure channel for authentication.
Nonetheless, many authentication mechanisms need some kind of secure channel,
such as an authenticated SSLconnection, before they can offer even reasonable security
levels.
In this chapter, we’ll sort through these technologies for connection establishment.
Note that in these recipes we cover only standalone technologies for authentication
and key exchange. In Chapter 9, we cover authentication with SSL/TLS, and in
Chapter 10, we cover authentication in the context of public key infrastructures
(PKI).
8.1 Choosing an Authentication Method
Problem
You need to perform authentication, and you need to choose an appropriate method.
362
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.