Problem - Kevin Tafuro

In addition, the user will need to keep some kind of physical token, like a sheet of
one-time passwords (which will occasionally need to be refreshed) or a calculator to
compute correct passwords. To avoid exposing the password if the server database is
compromised, the user will also need to reinitialize the server from time to time (and
update her calculator).
These mechanisms do not provide their own secure channel. S/KEY, as specified,
relies on MD4, which is now known to be cryptographically broken. If it’s used on
an unencrypted channel, no information about the password is revealed, but an
attacker can potentially hijack a connection.
CRAM
CRAM (Challenge-Response Authentication Mechanism) is a password-based protocol
that avoids sending the password out over the wire by using a challenge-response
protocol, meaning that the two ends each prove to the other that they have the
secret, without someone actually sending the secret. Therefore, CRAM (which does
not itself provide a secure channel) can be used over an insecure channel. However,
it is still subject to a number of password attacks on the server, particularly because
the server must store the actual password. Therefore, you should not use CRAM in
new systems.
Digest-Auth (RFC 2617)
Digest-Auth is one of the authentication mechanisms specified for HTTP/1.1 and
later (the other is quite weak). It does not provide a secure channel, and it provides
only moderate protections against attacks on passwords (much of it through an
optional nonce that is rarely used).
SRP
All of the mechanisms we’ve looked at so far have been password-based. None of
them create their own secure channel, nor do they provide mutual authentication.
SRP (Secure Remote Password) is a password-based mechanism that does all of the
above, and it has a host of other benefits:
Client-server authentication
SRP not only allows a server to authenticate clients, but it also allows clients to
know that they’re talking to the right server—as long as the authentication database
isn’t stolen.
Protection against information leakage
SRP also prevents all but a minimal amount of information leakage. That is, an
attacker can try one password at a time by contacting the server, but that is the
only way he can get any information at all about the password’s value. Throttling
the number of allowed login attempts to a few dozen a day should reasonably
thwart most attacks, though it opens up a denial of service risk. You might
368 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.