- db-wg - mailman.ripe.net

MD5 proposal
by Andrei Robachevsky 10 Apr '02

10 Apr '02

Dear Colleagues, You may remember that at the RIPE-41 it was agreed to improve the security of password(passphrase) based auth-schemes by introducing the MD5 hash algorithm for password encryption. Please find enclosed the MD5 proposal for your comments and suggestions. Regards, Andrei Robachevsky DB Group Manager RIPE NCC Improving security of password (passphrase) based auth schemes (MD5 proposal) -============================================================================- Introduction ------------ Currently the RIPE Database implements the only password based "auth" scheme, which is "CRYPT-PW" scheme. This scheme uses an encryption process which is similar to that used to make and check login passwords in UNIX. A password is chosen by the user; this is encrypted using DEC crypt(3) and put in the database. The encrypted password can be seen by everyone. The user sends the clear password in the same mail as the request to change an object using "password:" pseudo-attribute. Motivation ---------- The main flaw of the CRYPT-PW scheme is that password is limited to 8 characters, which makes exhaustive searches of the key space possible given that crypted password is publicly available. Also the DES algorithm itself has a few quirks which lower the security of the scheme. Allowing longer keys and using more secure encryption algorithm could improve security of password-based auth scheme. Proposal -------- A new "auth:" scheme is introduced based on MD5 hash algorithm. The format of the new "auth" scheme is: auth: MD5-PW <digest> where <digest> is a 128-bit MD5 digest. For example: auth: MD5-PW 4aabd3dbc0746c8a4b5467f99a4f8524 When submitting an update to the database that needs to be authorised using this scheme, a "password:" pseudo-attribute must be used to submit a key (passphrase). Line continuation is not allowed for this attribute, so the whole key should fit on one line. If the key gets split across multiple lines this will be treated as syntax error. If the mntner that defines authorisation information for the submission has CRYPT-PW and MD5-PW "auth" schemes, the key specified by "password:" will be checked for both types.

8 14

Re: MD5 proposal
by Poul-Henning Kamp 02 Apr '02

02 Apr '02

In message <20020325130131.T20936(a)isnic.is>, Olafur Osvaldsson writes: >> auth: MD5-PW 4aabd3dbc0746c8a4b5467f99a4f8524 >> > >Why not use md5 crypt wich is already used on many operating systems for >passwords? > >auth: MD5-PW $1$sD9e4pQn$1832L4.BxsZHusy0plg8i0 The source can be found here: http://www.freebsd.org/cgi/cvsweb.cgi/src/lib/libcrypt/crypt-md5.c -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 phk(a)FreeBSD.ORG | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence.

1 0

Re: MD5 proposal
by Olafur Osvaldsson 02 Apr '02

02 Apr '02

Hi, On Mon, 25 Mar 2002, Andrei Robachevsky wrote: > Proposal > -------- > > A new "auth:" scheme is introduced based on MD5 hash algorithm. The format > of the new "auth" scheme is: > > auth: MD5-PW <digest> > > where <digest> is a 128-bit MD5 digest. > > For example: > > auth: MD5-PW 4aabd3dbc0746c8a4b5467f99a4f8524 > Why not use md5 crypt wich is already used on many operating systems for passwords? auth: MD5-PW $1$sD9e4pQn$1832L4.BxsZHusy0plg8i0 /Oli -- Olafur Osvaldsson Systems Administrator Internet a Islandi hf. Tel: +354 525-5291 Email: oli(a)isnic.is

1 0

Flap Viewer
by Fabrizio Lombardozzi 02 Apr '02

02 Apr '02

Hi ris-users, my name is Fabrizio Lombardozzi, I've developed a system to monitor inter-AS routing instabilities (route flaps) at the Computer Networks Research Group, of the Roma III University, Italy. The system retrieves BGP data from RIS, and produces interactive graphs and animations using a graph drawing engine and intuitive morphing animations, with a reasonably friendly web graphic user interface (it's an applet). I will be grateful if you could give me some comments and hopefully suggestions. At the url http://www.dia.uniroma3.it/~compunet/ you will find detailed instructions to start the applet and also a gallery with screenshots and animations. Thanks in Advance Fabrizio

2 2

Re: MD5 proposal
by Lutz Donnerhacke 02 Apr '02

02 Apr '02

On Mon, Apr 01, 2002 at 01:32:24AM +0300, Andrei Robachevsky wrote: > Allowing longer keys and using more secure encryption algorithm could > improve security of password-based auth scheme. > > A new "auth:" scheme is introduced based on MD5 hash algorithm. The format > of the new "auth" scheme is: > > auth: MD5-PW <digest> > > where <digest> is a 128-bit MD5 digest. > > For example: > > auth: MD5-PW 4aabd3dbc0746c8a4b5467f99a4f8524 Please allow me to disturb your discussion. Using only a hash of a secret does protect the structure of the secret, but does not increase the security itself. The security risk a password protection scheme protects against is unauthorised access. This scheme is obviously vulnerable against eyesdropping. Replacing the secret by a hash of the secret does change nothing of this scheme. The hash does protect against attackers seeking for structured secrets (i.e. Customer-ID || "-" || Service), which allow them to guess other secrets correctly. So a hash does only protect customers with correlated, easy guessable passwords. Futhermore this protection is weak, because those secrets can be determined by a simple dictionary attack. In order to really increase security there are two easy to implement variants: Descending Hashes (transaction hashes) Store a hash in your database as usual. A message is valid, if they HASH in the message can be hashed in a limited number of steps to the stored one. Then (with a time window for disordered messages) replace the stored hash by the new one. To reset the hash, allow a new syntax: SET-HASH authorised by this scheme itself to set this new value instead of the hash used for authentification. Example: Hash Generation: Choose a secret => [h(=@X&Z Genereate a number of hashes => 0cad040d8049d9b612009821981ea1be (shorten to demonstrate) => 9b7a384557c7b80d321ae00e3ac40c79 => 980982910baed9b8642b5254b2ca495b => c1322fe1ea006cbc265e4efde666724d => b1b7a8a865734a4d4042f99441bda01e Store the initial hash "b1b7a8....da01e" in the DB. Send a authenticated message with the hash "c1322f...724d". Verification "echo -n 'c1322f...724d' | md5sum -b" successful and therefore the hash in the database is replaced by "c1322f...724d". Keyed Hashes Store a secret in your database as usual. A message is valid, if some header lines, followed by the whole body of the message (but without the hash line itself), and followed by the line: "Password: >>secret<<" hashes to the same result as provided in the HASH line. Pro and Cons: Transaction hashes are easy to compute even on Windows systems. Keyed hashes are difficult to compute on integrated mail systems. Transaction hashes are convertion independed. Keyed hashes should be taken the MIME way to be robust (software required). Transaction hashes require organisational prerequisites to be multiuser able. Keyed hashes can be computed indiviually. Transaction hashes require a sort of ordered message processing. Keyed hashes can be verified in any order. Transaction hashes provide an autoaging. Keyed hashes (without header processing) allow replay attacks. Enough?

1 0

Re: MD5 proposal
by Andrei Robachevsky 02 Apr '02

02 Apr '02

Ulf Kieber wrote: > Andrei Robachevsky writes: > >>>At the first character after the first white space (space or tab) >>> >>>>following the colon (":") >>>> >> >>>When submitting an update to the database that needs to be authorised using >>>this scheme, a "password:" pseudo-attribute must be used to submit a key >>>(passphrase). Line continuation is not allowed for this attribute, so the >>>whole key should fit on one line. If the key gets split across multiple >>>lines this will be treated as syntax error. >>> >> >>The value of the key starts at the first character after the first white >>space following the colon (":"). >> > > If I understand you and Engin's previous comment correctly, this would > change current behaviour, which is according to Engin's comment > > ``key starts after the first non-white space character after the colon'' > > Don't! This would most probably break people's scripts. > Sorry, I wasn't clear. ``Key starts at the first non-white space character after the colon''. That's how it works now. -- Andrei

1 0

Re: Deprecation of the MAIL-FROM auth scheme
by Christoph Kuhles / Aquatix RIPE services 01 Apr '02

01 Apr '02

Dear Andrei & list, talking about a secure database, I wonder why the crypted password is shown when using CRYPT-PW as authentication scheme? While it might take long to get the clear-text password using brute force or dictionary attacks, it is still possible. Why not patch the whois server so it doesn't show the crypted password and hence make hijacking of objects impossible by bruteforcing a maintainer password? Best regards Christoph Kuhles Managing Director Aquatix IT-Services e.K. Monday, March 25, 2002, 1:58:10 PM, you wrote: AR> Please find enclosed the migration plan to a more secure database.

1 0

Re: Deprecation of the MAIL-FROM auth scheme
by Janos Zsako 01 Apr '02

01 Apr '02

> From owner-db-wg(a)ripe.net Mon Mar 25 13:58:43 2002 > From: Andrei Robachevsky <andrei(a)ripe.net> Andrei, > In case a mntner contains only one "auth" scheme, which is MAIL-FROM, it > will be replaced with a CRYPT-PW scheme with a DES string that cannot be > matched. Why don't you add "CRYPT-PW azsLXaNunJ9Rs", which is the auth of RIPE-NCC-HM-MNT? This way the hostmaster team could easily update a mntner object when the "authorized and authenticated" maintainer shows up and asks you to perform the update ("authorized and authenticated" above refers to the procedure you have in place for dealing with such cases.) Best regards, Janos PS. Otherwise, I guess you need a special mechanism to update such "orphaned" maintainers...

1 0

Re: MD5 proposal
by Janos Zsako 01 Apr '02

01 Apr '02

> From owner-db-wg(a)ripe.net Mon Mar 25 14:29:46 2002 > From: Engin Gunduz <engin(a)ripe.net> > > Let's suppose I send in a message with > > password: Hello > > (note the three spaces). > > > > It is not clear to me where the passphrase would start. I can think of > > two valid approaches: > > 1. At the first character after the first white space (space or tab) > > following the colon (":") (in my example the passphrase would be then > > " Hello"). > > 2. At the first non-whitespace character after the colon (in which case > > the passphrase would be "Hello"). > > > > I think I would vote for the second approach which is more intuitive > > to me. BTW: how does this work with CRYPT-PW? I would think it is the > > second approach. > > Yes, the current approach is the second one. This implicitely > prohibits the use of white space as the first characters of the > password but probably this is less confusing for the users then > having the behaviour you defined in 1. > I don't think this is documented. We'll make sure it will > be in the user manual, and in reference document if > necessary. Great! Thanks. Best regards, Janos

1 0

Re: MD5 proposal
by Engin Gunduz 01 Apr '02

01 Apr '02

Hi Janos, On Mon, 25 Mar 2002, Janos Zsako wrote: > > From owner-db-wg(a)ripe.net Mon Mar 25 13:26:38 2002 > > Dear Andrei, > > > Please find enclosed the MD5 proposal for your comments and suggestions. > > Great! > > One small comment, probably need for clarification. > > > When submitting an update to the database that needs to be authorised using > > this scheme, a "password:" pseudo-attribute must be used to submit a key > > (passphrase). Line continuation is not allowed for this attribute, so the > > whole key should fit on one line. > > Let's suppose I send in a message with > password: Hello > (note the three spaces). > > It is not clear to me where the passphrase would start. I can think of > two valid approaches: > 1. At the first character after the first white space (space or tab) > following the colon (":") (in my example the passphrase would be then > " Hello"). > 2. At the first non-whitespace character after the colon (in which case > the passphrase would be "Hello"). > > I think I would vote for the second approach which is more intuitive > to me. BTW: how does this work with CRYPT-PW? I would think it is the > second approach. Yes, the current approach is the second one. This implicitely prohibits the use of white space as the first characters of the password but probably this is less confusing for the users then having the behaviour you defined in 1. > > Best regards, > Janos > > PS: I apologize if this is specified somewhere. I don't think this is documented. We'll make sure it will be in the user manual, and in reference document if necessary. Best regards, Engin Gunduz RIPE NCC Database Group

1 0