W3C home > Mailing lists > Public > ietf-http-wg-old@w3.org > January to April 1998

RE: Some comments on Digest Auth

From: Paul Leach <paulle@microsoft.com>
Date: Wed, 21 Jan 1998 11:12:09 -0800
Message-Id: <5CEA8663F24DD111A96100805FFE6587031E38BE@red-msg-51.dns.microsoft.com>
To: "'David W. Morris'" <dwm@xpasc.com>
Cc: "'dmk@research.bell-labs.com'" <dmk@research.bell-labs.com>, http-wg@cuckoo.hpl.hp.com
There are authentication algorithms that get rid of plain-text and that
still allow a recovered password to be used against other systems. (Digest
would be one if it didn't mix the realm name into the key used to compute
the response. I wouldn't be suprised if that weren't accidental -- the CRAM
MD5 protocol being used in POP3 and other mail protocols does not have that
property.)

So, I'm not complaining about the current digest spec -- I just don't want
the criterion to be "it's not plaintext, so it's OK".

The following criteria are fine by me:
1. Recovery of the password on one system doesn't allow its use on another
2. Replay attacks are limited to a reasonably small time window, and
implementations can practically make it quite small.
3. Brute force attack is infeasible on well chosen passwords.
	 
Paul
Received on Wednesday, 21 January 1998 11:13:35 EST

This archive was generated by hypermail pre-2.1.9 : Wednesday, 24 September 2003 06:33:11 EDT