Problem - Kevin Tafuro

key agreement protocol, where both sides contribute to the key, instead of a key
transport protocol, where one side selects the key and sends it to the other.
Forward secrecy
You might want to require that an attacker who manages to break one key
exchange should not be able to decrypt old connections, if he happens to capture
the data. Achieving this property often involves some tradeoffs.
Let’s look at common technologies in light of these requirements.
Traditional UNIX crypt( )
This solution is a single-factor, password-based system. Using it requires a preexisting
secure channel (and one that thwarts capture replay attacks). There are big windows
of vulnerability because the user’s password must be sent to the server every
time the user wishes to authenticate. It does not meet any of the desirable security
requirements for a password-based system we outlined above (it is susceptible to
offline guessing attacks, for example), and the traditional mechanism is not even very
strong cryptographically. Using this mechanism on an unencrypted channel would
expose the password. Authentication using crypt( ) is covered in Recipe 8.9.
MD5 Modular Crypt Format (a.k.a. md5crypt or MD5-MCF)
This function replaces crypt( ) on many operating systems (the API is the same, but
it is not backward-compatible). It makes offline cracking attacks a little harder, and it
uses stronger cryptography. There are extensions to the basic modular format that
use other algorithms and provide better protection against offline guessing; the
OpenBSD project’s Blowfish-based authentication mechanism is one. Using this
mechanism on an unencrypted channel would expose the password. Authentication
using MD5-MCF is covered in Recipe 8.10.
PBKDF2
You can use PBKDF2 (Password-Based Key Derivation Function 2; see Recipe 4.10)
as a password storage mechanism. It meets all the same requirements as the Blowfish
variant of MD5-MCF discussed in the previous subsection. Authentication using
PBKDF2 is covered in Recipe 8.11.
S/KEY and OPIE
S/KEY and OPIE are one-time password systems, meaning that the end user sends a
different password over the wire each time. This requires the user and the server to
preestablish a secret. As a result, if an attacker somehow gets the secret database (e.g.,
if he manages to dumpster-dive for an old backup disk), he can masquerade as the client.
Choosing an Authentication Method | 367
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.