1
2
3
4
5
6
7Network Working Group                             Love Hornquist Astrand
8<draft-hornquist-astrand-krb-wg-srp.txt>          Stockholms universitet
9Internet-Draft                                            December, 2003
10Expire in six months
11
12            Using SRP for Initial Authentication in Kerberos
13
14Status of this Memo
15
16ftp://ftp.rfc-editor.org/in-notes/rfc-editor/instructions2authors.txt
17
18   This memo provides information for the Internet community. ...
19
20Copyright Notice
21
22   Copyright (C) The Internet Society (2003).  All Rights Reserved. ...
23
24
25Abstract
26
27   This document describes how to use SRP as a preauthentication
28   mechanism in Kerberos 5 [RFC1510].  This mechanism makes the initial
29   ticket request and response secure against dictionary attacks on
30   users passwords.
31
32Introduction
33
34   Kerberos without preauthentication make the protocol susceptible to
35   both to password dictionary attacks on initial tickets.  There are
36   several pre-authentication mechanisms that tries to solve and/or
37   minimize this problem.
38
39   Encrypted time stamp have the same problem as Kerberos without
40   preauthentication, opportunities of the attacker to get key material
41   is only fewer.  SAM require hardware token and typically, for most
42   SAM types, still require the user to have a password since they don't
43   provide enough key-material for Kerberos to encrypt the response
44   with.  PKINIT large and complicated, and like SAM often require
45   hardware.  Extra-tgt requires infrastructure to use, a key/bootstrap
46   must be present on each host that the users are expected to use.
47
48   The dictionary attack can also be solved by forcing the users to
49   select good password.
50
51   XXX Jacques' DH preauth ?
52   XXX tls protected as-req
53
54   SRP, Secure Remote Password protocol, [RFC2945], is a password
55
56
57
58Hornquist Astrand                                               [Page 1]
59
60Internet Draft                                            December, 2003
61
62
63   authentication and key-exchange protocol that can be used over
64   untrusted networks.  SRP is designed to be resistable to dictionary
65   attacks (both by passive and active attackers).
66
67Specification
68
69   This document is based on SRP-6.
70
71   XXX read and think about rfc2944 (SRP over telnet)
72
73   SRP + Kerberos 5 preauthentication
74
75   Krb-srp-cookie in the protocol to enable the server be stateless.
76
77   TBA KRB-SRP-PREAUTH number
78
79   - Client send the AS-REQ
80
81   - Server looks up the principal, and finds N, g, v, salt, H.  Then
82   the server generates the random number b and calculate B.  All
83   operations are performed modulus N.
84
85        B = 3v + g^b
86
87   and sends back a KRB-SRP-CHALLENGE md-data in a KRB-ERROR. If the
88   server is stateless, it can store the information (encrypted) it
89   needs in krb-srp-cookie.
90
91   - If the client chooses to use the SRP preauthentication mechanism it
92   sends back KRB-SRP-CLIENT-RESPONSE.  If krb-srp-cookie is present in
93   KRB-SRP-CHALLENGE its copied to KRB-SRP-CLIENT-RESPONSE.  The client
94   generates the random number a and calculates
95
96        A = g^a
97        S = (B - 3g^x)^(a+ux)
98        M1 = H(DER(A) | DER(B) | DER(S))
99
100   u is H(DER(A) | DER(B)), where DER(n) is the n encoded with the
101   integer tag.
102
103   The client then it calculates the shared key K
104
105        K = s-to-key-bytes(S)
106
107   KRB-SRP-CLIENT-RESPONSE-ENC-DATA is filled in by the client,
108   encrypted with the shared key K
109
110   XXX should a keyed checksum just be used instead ?
111
112
113
114Hornquist Astrand                                               [Page 2]
115
116Internet Draft                                            December, 2003
117
118
119   XXX does this replace the need for M1
120
121   - When the server receives the KRB-SRP-CLIENT-RESPONSE response it
122   calculates
123
124        S = (Av^u)^b
125
126   and the shared key K,
127
128        K = s-to-key-bytes(S)
129
130   verifies the content in krb-srp-enc, and M1.  If everything checks
131   out ok, the server sends back the AS-REP.  The key that the AS-REP is
132   encrypted with is the SRP session key, K.
133
134   XXX Should the server send back M2 ?
135
136   s-to-key defined as:
137
138        b = DER(S)
139        if length of b is even, drop first char
140        b1 = H(b[0] | b[2] | b[4] | ...)
141        b2 = H(b[1] | b[3] | b[5] | ...)
142        K = random-to-key(b1 | b2).
143
144   random-to-key is the random to key function in [KCRYPTO].
145
146ASN.1 specification
147
148   XXX Krb-Nonce
149
150   KERBEROS-PREAUTH-SRP DEFINITIONS ::=
151
152   BEGIN
153
154   IMPORTS Checksum, Krb-Nonce FROM krb5;
155
156   KRB-SRP-CHALLENGE ::= SEQUENCE {
157           krb-srp-salt[0]         OCTET STRING,
158           krb-srp-N[1]            INTEGER,
159           krb-srp-g[2]            INTEGER,
160           krb-srp-B[3]            INTEGER,
161           krb-srp-hash[4]         OBJECT IDENTIFIER,
162           krb-srp-flags[5]        INTEGER (SIZE 4),
163           krb-srp-cookie[6]       OCTET STRING OPTIONAL -- must include nonce ?
164   }
165
166   -- flags: "use combined s2k + srp key" ?
167
168
169
170Hornquist Astrand                                               [Page 3]
171
172Internet Draft                                            December, 2003
173
174
175   KRB-SRP-CLIENT-RESPONSE ::= SEQUENCE {
176           krb-srp-A[0]            INTEGER,
177           krb-srp-M1[1]           OCTET STRING,
178           krb-srp-hash[2]         OBJECT IDENTIFIER,
179           krb-srp-enc[3]          EncryptedData, -- bind nonce to pa
180           krb-srp-cookie[4]       OCTET STRING OPTIONAL
181   }
182
183   KRB-SRP-CLIENT-RESPONSE-ENC-DATA :: SEQUENCE {
184           krb-srp-checksum[0]     Checksum,
185           krb-srp-flags[1]        INTEGER (SIZE 4),
186           krb-srp-nonce[2]        Krb-Nonce
187   }
188
189   KRB-SRP-SERVER-RESPONSE ::= SEQUENCE {
190           krb-srp-M2[0]           OCTET STRING
191   }
192
193   END
194
195Issues
196
197   send group/generator by name ?
198
199   how to bind request to pa data ?
200
201   what key should be used, the key from SRP, or the compiled key from
202   s2k + SRP, right now its a flag.
203
204Requirements on the KDC
205
206   The KDC needs to know more information for each principal.  At least
207   the KDC needs to store:
208
209   N, the safe prime
210   g, the generator
211   v, the password verifier
212   salt, that salt that the principal used to form the verifier, v
213   H, hash function used to form the verifier, v
214
215   Also, since the KDC no longer have a list of keys, and thus an
216   implicit list what encryption types the principal is allowed use, it
217   needs to have a list for all the encryption types a user is allowed
218   to use with SRP preauthentication mechanism.
219
220Security considerations
221
222   SRP
223
224
225
226Hornquist Astrand                                               [Page 4]
227
228Internet Draft                                            December, 2003
229
230
231   see Security considerations in Nisses SSH SRP draft.
232
233   Kerberos
234
235   Preauthentication
236
237   SRP preauthentication mechanism doesn't require the client to compute
238   something before the server sends "expensive" cryptographic
239   operations.
240
241   Preauthentication have the problem that the response is not
242   authenticated, so a active attacker can modify that response from the
243   KDC to remove SRP to have the client choose a weaker initial
244   authentication method.
245
246References
247
248   [RFC1510] Kohl, J. and Neuman, C., "The Kerberos Network
249   Authentication Service (V5)", RFC 1510, September 1993.
250
251   [SRP] T. Wu, "The Secure Remote Password Protocol", In Proceedings of
252   the 1998 ISOC Network and Distributed System Security Symposium, San
253   Diego, CA, pp. 97-111.
254
255   [RFC2945] Wu, T, "The SRP Authentication and Key Exchange System",
256   RFC2945, September 2000.
257
258   [KCRYPTO] Raeburn, K., "Encryption and Checksum Specifications for
259   Kerberos 5", draft-ietf-krb-wg-crypto-05.txt, June, 2003.  Work in
260   progress.
261
262Author's Address
263
264   Love Hornquist Astrand
265   Enheten for it och media
266   Stockholms universitet
267   S-106 91  STOCKHOLM
268   SWEDEN
269
270   EMail: lha@it.su.se
271
272Full Copyright Statement
273
274   Copyright (C) The Internet Society (2003). All Rights Reserved. ...
275
276
277
278
279
280
281
282Hornquist Astrand                                               [Page 5]
283
284