Problem - Kevin Tafuro

consider slightly more sophisticated throttling, such as a limit of 12 times a day
per IP address. (Of course, even that is not perfect). A far less restrictive method
of throttling failed authentication attempts is discussed in Recipe 8.8.
Protection against compromise
SRP protects against most server-compromise attacks (but not a multiserver
masquerading attack, which we do not think is worth worrying about anyway).
It even prevents an attacker who compromises the server from logging into other
machines using information in the database.
Key exchange
Another big benefit is that SRP exchanges a key as a side effect of authentication.
SRP uses public key cryptography, which can be a denial-of-service issue.
The big problem with SRP is that patents cover it. As a result, we do not explore SRP
in depth. Another potential issue is that this algorithm does not provide forward
secrecy, although you could easily introduce forward secrecy on top of it.
Basic public key exchange
There are plenty of strong authentication systems based on public key cryptography.
These systems can meet most of the general requirements we’ve discussed, depending
on how they’re implemented.
Generally, the public key is protected by a password, but the password-protected key
must be transported to any client machine the user might wish to use. This is a major
reason why people often implement password-based protocols instead of using public
key-based protocols. We discuss a basic protocol using public key cryptography
in Recipe 8.16.
SAX
SAX (Symmetric Authenticated eXchange) is a protocol that offers most of the same
benefits of SRP, but it is not covered by patents. Unlike SRP, it does not use public
key encryption, which means that it minimizes computational overhead. There is a
masquerading attack in the case of server compromise, but it effectively requires
compromise of two servers and does not buy the attacker any new capabilities, so it
is not very interesting in practice.
SAX has two modes of use:
• You can avoid leaking any information about the password if the user is willing
to carry around or memorize a secret provided by the server at account creation
time (that secret needs to be entered into any single client only once, though).
• Otherwise, SAX can be used in an SRP-like manner, where the user need not
carry around anything other than the password, but information about the password
can be learned, but primarily through guessing attacks. Someone can
Choosing an Authentication Method | 369
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.