Subject: Re: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login sniffer and cracker for Windows 2000/X

From: "Tolga Acar" <[email-masked]>
Date: Wed, 04 Dec 2002 14:21:13 -0700

There are a few publications on password-based public keys, or ID-based PK systems, like from Hugo Krawzcyk and Dan Boneh amongst others.

One problem I see is, the length of the prime under condition "n = largest prime less than k". k is a small number in the range or a few hundred bits. A prime ought to be 512 bits minimum for a DH-like exchange.

- Tolga

- Tolga
>>> "Douglas E. Engert" <[email-masked]> 12/04/02 08:23 AM >>>
DH is based on  X=g**x mod n and Y=g**y mod n where g and n are 
publicly known. But what if g and n where based on the user's key, 
and known only to the user and the KDC?

Then the MITH would not have access to g or n.

One way to generate g and n might be,
 n = largest prime less then k,(or (n-1)/2 ) is prime.  
 g = k - n; special cases like g=0 or g=1   

I came up with this last night driving home. It may have flaws,
or may even be patented. Any thoughts, especially on how to generate
n and/or g from the key.

Here is another one What about the "22.6 Fortified Key Negotiation"
as defined in "Applied Cryptography"  It looks like a MITM would
be detected, or would have to mount multiple MITM attacks to get
one password. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 04 Dec 2002 16:41:07 -0600

As was pointed out, the proposal to generate n from k is used in:
"PDM: A New Strong Password-Based Protocol"
http://www.securitycentric.com/files/ipsec_key_exchange.pdf

--