Subject: Some questions on the password cracking issue

From: [email-masked] (Sam Hartman)
Date: Mon, 2 Dec 2002 16:07:46 -0500 (EST)

1) Are the set of keyed machines important enough as Kerberos clients
   that we should consider optimizing a solution for that case?

2) If we do solve the keyed machine problem as a special case, should
   we reduce the number of round trips by restricting our solution to
   clients with host principals in the same realm as the AS request is
   destined for?

3) How much do we care about MITM attacks?  Is detection of these
   attacks necessary?  Is it sufficient?

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 16:15:05 -0500

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

    Sam> 1) Are the set of keyed machines important enough as Kerberos
    Sam> clients that we should consider optimizing a solution for
    Sam> that case?

I believe so.  If the solution we come up with for non-keyed clients
is sufficient we should not worry about this issue.

    Sam> 2) If we do solve the keyed machine problem as a special
    Sam> case, should we reduce the number of round trips by
    Sam> restricting our solution to clients with host principals in
    Sam> the same realm as the AS request is destined for?

Probably.  Many of the proposed solutions are introducing a lot of
round trips.  We should certainly at least consider ways of reducing
this.

    Sam> 3) How much do we care about MITM attacks?  Is detection of
    Sam> these attacks necessary?  Is it sufficient?

I think that detecting MITM is sufficient.  I'm not quite sure it is
necessary.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 13:27:16 -0800

>    that we should consider optimizing a solution for that case?

Maybe.  Would we be increasing the usage of the client's long term key
in the process?  Is that an issue?

>    clients with host principals in the same realm as the AS request is

No, there's no need to restrict the solution to initial authentication
of users in the same realm as the client, particularly since that would
be a rather artificial limitation if the solution works by having the
client send a ticket in its host key along with the AS-REQ.

>    attacks necessary?  Is it sufficient?

MITM attacks should either not be possible or they should be detectable.

Cheers,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 13:28:11 -0800

> in the process?  Is that an issue?

Ooops, I mis-read the question.

The answer, for me, is yes.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Dec 2002 16:31:08 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Mon, Dec 02, 2002 at 04:07:46PM -0500, Sam Hartman
    Nicolas> wrote:
    >> 
    >> 
    >> 1) Are the set of keyed machines important enough as Kerberos
    >> clients that we should consider optimizing a solution for that
    >> case?

    Nicolas> Maybe.  Would we be increasing the usage of the client's
    Nicolas> long term key in the process?  Is that an issue?

We'd be increasing the usage of the client long-term key.
It's random; I think that's much more acceptable than a password-based key.

    >> 2) If we do solve the keyed machine problem as a special case,
    >> should we reduce the number of round trips by restricting our
    >> solution to clients with host principals in the same realm as
    >> the AS request is destined for?

    Nicolas> No, there's no need to restrict the solution to initial
    Nicolas> authentication of users in the same realm as the client,
    Nicolas> particularly since that would be a rather artificial
    Nicolas> limitation if the solution works by having the client

There's no need; the question is would it be worth saving round trips
for hosts in the same realm?

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 13:33:36 -0800

> for hosts in the same realm?

This is where the increased usage of the client's long-term key comes
in.  I think I agree, it is minor and not significant, so, yes, I think
we can optimize for the case where the user principal and the client
principal are in the same realm.

Nico

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 03 Dec 2002 13:06:07 -0500

>    that we should consider optimizing a solution for that case?

Yes.

>    clients with host principals in the same realm as the AS request is

Probably, but as an optimization only, not a restriction.

>    attacks necessary?  Is it sufficient?

If any sort of remotely practical MITM attack is possible, it must be
detectable.  I'd prefer it not be possible at all, obviously.

---

From: Lawrence Greenfield <[email-masked]>
Date: Tue, 03 Dec 2002 13:26:20 -0500

>    that we should consider optimizing a solution for that case?

It doesn't seem necessary to have a seperate mechanism for keyed machines 
if we have a good general purpose mechanism.

>    attacks necessary?  Is it sufficient?

Also, what if the MITM can succeed undetected if the attacker can exhaust a 
password during the protocol negotiation? A typical password has, what, 40 
to 50 bits of entropy in it? How long until those exhausts can be done fast 
enough to successfully avoid detection?

Larry

---

From: Sam Hartman <[email-masked]>
Date: Tue, 03 Dec 2002 13:44:03 -0500

>>>>> "Lawrence" == Lawrence Greenfield <[email-masked]> writes:

    Lawrence> Also, what if the MITM can succeed undetected if the
    Lawrence> attacker can exhaust a password during the protocol
    Lawrence> negotiation? A typical password has, what, 40 to 50 bits
    Lawrence> of entropy in it? How long until those exhausts can be
    Lawrence> done fast enough to successfully avoid detection?

With the AES string2key function we allow people to scale the effort
required to run string2key.  I hope that EKE will expire before you
get to a point where you can do enough AES string2key operations to
brute-force passwords in real-time.