Subject: RE: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login sni ffer and cracker for Windows 2000/XP]

From: Tim Alsop <[email-masked]>
Date: Mon, 2 Dec 2002 15:13:31 -0000

All,

I found a URL which might be of interest :

http://www.brd.ie/papers/w2kkrb/feasibility_of_w2k_kerberos_attack.htm

You will notice about 60% down this page there is a table showing the
estimated time needed to brute force a password with different password
complexities. I think we all know that any authentication mechanism using
passwords will be open to this sort of attack, but sometimes practicalities
need to be considered also. For example, if my password policy causes my
users to have a password that is complex enough so that a potential brute
force will take 4206 years then I would be quite happy since nobody will
live long enough to run such an attack. I am sure we don't expect an
organisation to encourage simple passwords, or do we ? Perhaps somebody
needs to look at the default password policy that Microsoft offer and
encourage them to improve their default to satisfy any customer concerns ?
Alternatively, they should consider two-factor authentication with their
Kerberos authentication.

Regards, Tim.

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]] 
Sent: 02 December 2002 14:29
To: Matt Crawford
Cc: [email-masked]
Subject: Re: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login
sniffer and cracker for Windows 2000/XP]

> > > If we still do not want Microsoft to begin using TLS to protect 
> > > TGT requests we need to come to an agreement quickly.  Probably 
> > > within days.
> > 
> > Okay, how about smb's suggestion to use anonymous Diffie-Hellman?
> 
> How about the suggestion to use DCE RFC 26.0?
> 
> 

DCE RFC 26.0 <http://www.opengroup.org/tech/rfc/mirror-rfc/rfc26.0.txt> is
not sufficient in that it assumes that the client machine is managed. This
is not the case for the vast majority of client machines. Therefore, there
would be no shared key to use to request the data.

The DCE approach also has limitations in a managed environment.  When a host
key is available it is only good for a specific KDC.  That means that if I
am logged into a machine in REALM BAR1.COM and need a TGT for REALM BAR2.COM
and there is no cross realm, my TGT request would again be vulnerable.

The ADH approach allows us to provide protection against passive attacks
although it does leave open a MITM attack.

 Jeffrey Altman * Volunteer Developer      Kermit 95 2.1 GUI available
now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP,
HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP,
and 
 [email-masked]               OpenSSL.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 15:55:53 -0500

>>>>> "Tim" == Tim Alsop <[email-masked]> writes:

    Tim> All, I found a URL which might be of interest :

    Tim> http://www.brd.ie/papers/w2kkrb/feasibility_of_w2k_kerberos_attack.htm

    Tim> You will notice about 60% down this page there is a table
    Tim> showing the estimated time needed to brute force a password
    Tim> with different password complexities. I think we all know
    Tim> that any authentication mechanism using passwords will be
    Tim> open to this sort of attack, but sometimes practicalities
    Tim> need to be considered also. For example, if my password
    Tim> policy causes my users to have a password that is complex
    Tim> enough so that a potential brute force will take 4206 years
    Tim> then I would be quite happy since nobody will live long
    Tim> enough to run such an attack. I am sure we don't expect an
    Tim> organisation to encourage simple passwords, or do we ?

We expect that if password policies are too restrictive, users will
write down passwords or otherwise make them more vulnerable to social
engineering.

We are also concerned about market reaction to stories about password
cracking.  It may be that we end up solving the problem for
political/marketing reasons rather than social reasons.

But you are correct that adequate password policy that is enforced and
that does not lead to social engineering issues is a adequate solution
to offline dictionary attacks.