Problem - Kevin Tafuro

mount an offline dictionary attack on the server side, but the cost of such an
attack can be made prohibitive.
If an attacker somehow gets the secret database (e.g., if he manages to dumpster-dive
for an old backup disk), he can masquerade as the client. PAX is a similar protocol
that fixes this problem.
PAX
PAX (Public key Authenticated eXchange) is a basic two-way authenticating key
exchange using public key encryption that uses passwords to generate the keys. The
server needs to know the password once at initialization time, and never again.
This protocol is similar to SAX, but has some minor advantages because it uses public
key cryptography. For example, you can back away from using passwords (for
example, you might take the key and put the client’s private key onto a smart card,
obviating the need to type in a password on the client end). Additionally, if an
attacker does get the authentication database, he nonetheless cannot masquerade as
the client.
PAX can be used in one of two modes:
• You can get all the advantages of a full public-key based system if the user is willing
to carry around or memorize a secret provided by the server at account creation
time (that secret needs to be entered into any single client only once,
though).
• Otherwise, PAX can be used in an SRP-like manner, where the user need not
carry around anything other than the password; information about the password
can be learned, but only through guessing attacks.
As with SRP, you can easily layer forward secrecy on top of PAX (by adding another
layer of cryptography; see Recipe 8.21).
Unlike SRP, PAX is not believed to be covered by patents.
Kerberos
Kerberos is a password-based authentication mechanism that requires a central
authentication server. It does not use any public key cryptography whatsoever,
instead relying on symmetric cryptography for encryption and authentication (typically
DES or Triple-DES in CBC mode with MD5 or SHA1 for authentication).
Although Kerberos never transmits passwords in the clear, it does make the assumption
that users will not use weak passwords, which is a poor assumption to make,
because users will invariably use passwords that they find easy to remember. That
typically also makes these passwords easy for an attacker to guess or to discover by
way of a dictionary attack.
370 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.