From nobody Tue Sep 30 12:02:25 2014 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 927E01A1A5E for ; Tue, 30 Sep 2014 12:02:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.167 X-Spam-Level: X-Spam-Status: No, score=-1.167 tagged_above=-999 required=5 tests=[BAYES_50=0.8, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OTORUkDJHbVT for ; Tue, 30 Sep 2014 12:02:22 -0700 (PDT) Received: from colo.trepanning.net (colo.trepanning.net [69.55.226.174]) by ietfa.amsl.com (Postfix) with ESMTP id 361CA1A8790 for ; Tue, 30 Sep 2014 12:02:15 -0700 (PDT) Received: from www.trepanning.net (localhost [127.0.0.1]) by colo.trepanning.net (Postfix) with ESMTP id 72CDF1022404C for ; Tue, 30 Sep 2014 12:02:15 -0700 (PDT) Received: from 69.12.173.8 (SquirrelMail authenticated user dharkins@lounge.org) by www.trepanning.net with HTTP; Tue, 30 Sep 2014 12:02:15 -0700 (PDT) Message-ID: Date: Tue, 30 Sep 2014 12:02:15 -0700 (PDT) From: "Dan Harkins" To: emu@ietf.org User-Agent: SquirrelMail/1.4.14 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Archived-At: http://mailarchive.ietf.org/arch/msg/emu/YZVJohm8cv4zUW1ATiNhLOqMHnk Subject: [Emu] salted EAP-pwd X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Sep 2014 19:02:23 -0000 Hello EMU, I've had requests to add support for salted password databases to EAP-pwd. A newly posted draft does just that: http://tools.ietf.org/html/draft-harkins-salted-eap-pwd-00 Please take a look and comment. regards, Dan. From nobody Tue Sep 30 14:19:02 2014 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D11D71A914C for ; Tue, 30 Sep 2014 14:18:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJgPf0KF0T_y for ; Tue, 30 Sep 2014 14:18:58 -0700 (PDT) Received: from smtp2.pacifier.net (smtp2.pacifier.net [64.255.237.172]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 645D31A9144 for ; Tue, 30 Sep 2014 14:18:58 -0700 (PDT) Received: from Philemon (winery.augustcellars.com [206.212.239.129]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp2.pacifier.net (Postfix) with ESMTPSA id C1D032CA1B; Tue, 30 Sep 2014 14:18:57 -0700 (PDT) From: "Jim Schaad" To: "'Dan Harkins'" , References: In-Reply-To: Date: Tue, 30 Sep 2014 14:16:29 -0700 Message-ID: <0e3a01cfdcf3$cdca13d0$695e3b70$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQJrPpFfgr3g/sqefUjDnX1/AEi665rjajdw Content-Language: en-us Archived-At: http://mailarchive.ietf.org/arch/msg/emu/ook0Tedy_RJ1W0PPrYVYKLQiHdM Subject: Re: [Emu] salted EAP-pwd X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Sep 2014 21:19:00 -0000 I can see two problems right off the bat. 1. It does not allow me to use a different salted method for different people so I can upgrade by salt function piecemeal. 2. It does not allow me to do both SASLprep and salting on the same password. Jim -----Original Message----- From: Emu [mailto:emu-bounces@ietf.org] On Behalf Of Dan Harkins Sent: Tuesday, September 30, 2014 12:02 PM To: emu@ietf.org Subject: [Emu] salted EAP-pwd Hello EMU, I've had requests to add support for salted password databases to EAP-pwd. A newly posted draft does just that: http://tools.ietf.org/html/draft-harkins-salted-eap-pwd-00 Please take a look and comment. regards, Dan. _______________________________________________ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu From nobody Tue Sep 30 16:24:48 2014 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D4931ACD1E for ; Tue, 30 Sep 2014 16:24:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.867 X-Spam-Level: X-Spam-Status: No, score=-3.867 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HlQkP9VgQYFn for ; Tue, 30 Sep 2014 16:24:44 -0700 (PDT) Received: from colo.trepanning.net (colo.trepanning.net [69.55.226.174]) by ietfa.amsl.com (Postfix) with ESMTP id 730FF1ACD15 for ; Tue, 30 Sep 2014 16:24:44 -0700 (PDT) Received: from www.trepanning.net (localhost [127.0.0.1]) by colo.trepanning.net (Postfix) with ESMTP id 1D7A01022404C; Tue, 30 Sep 2014 16:24:44 -0700 (PDT) Received: from 104.36.248.10 (SquirrelMail authenticated user dharkins@lounge.org) by www.trepanning.net with HTTP; Tue, 30 Sep 2014 16:24:44 -0700 (PDT) Message-ID: In-Reply-To: <0e3a01cfdcf3$cdca13d0$695e3b70$@augustcellars.com> References: <0e3a01cfdcf3$cdca13d0$695e3b70$@augustcellars.com> Date: Tue, 30 Sep 2014 16:24:44 -0700 (PDT) From: "Dan Harkins" To: "Jim Schaad" User-Agent: SquirrelMail/1.4.14 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Archived-At: http://mailarchive.ietf.org/arch/msg/emu/GFRJ_NoMjM3nA0Y3eNzkgN99Rpc Cc: emu@ietf.org Subject: Re: [Emu] salted EAP-pwd X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Sep 2014 23:24:46 -0000 Hi Jim, On Tue, September 30, 2014 2:16 pm, Jim Schaad wrote: > I can see two problems right off the bat. > > 1. It does not allow me to use a different salted method for different > people so I can upgrade by salt function piecemeal. Sure it does. The EAP-Identity/Response from the client will indicate the identity, the server looks up that identity in the password database, sees how it's salted and responds appropriately. One entry in the database could be SHA-1 and another could be SHA-256. > 2. It does not allow me to do both SASLprep and salting on the same > password. Yes, I see that might be needed if SASLprep was done on the password before it was salted and stored. Given that SASLprep is already a password pre-processing technique (and it is the value 0x02 while "none" is 0x00 preventing the distinction being a low-order bit) I see no choice but to double all the proposed salting indicators, one for SASLprep before the hashing and one for do nothing to the password before hashing. Would that be satisfactory to you? regards, Dan. > Jim > > > -----Original Message----- > From: Emu [mailto:emu-bounces@ietf.org] On Behalf Of Dan Harkins > Sent: Tuesday, September 30, 2014 12:02 PM > To: emu@ietf.org > Subject: [Emu] salted EAP-pwd > > > Hello EMU, > > I've had requests to add support for salted password databases to > EAP-pwd. > A newly posted draft does just that: > > http://tools.ietf.org/html/draft-harkins-salted-eap-pwd-00 > > Please take a look and comment. > > regards, > > Dan. > > > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > > From nobody Tue Sep 30 17:16:29 2014 Return-Path: X-Original-To: emu@ietfa.amsl.com Delivered-To: emu@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B97D01A8A82 for ; Tue, 30 Sep 2014 17:16:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kVi3PK1vChnW for ; Tue, 30 Sep 2014 17:16:25 -0700 (PDT) Received: from smtp3.pacifier.net (smtp3.pacifier.net [64.255.237.177]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D27DE1ACD2C for ; Tue, 30 Sep 2014 17:16:25 -0700 (PDT) Received: from Philemon (winery.augustcellars.com [206.212.239.129]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp3.pacifier.net (Postfix) with ESMTPSA id 3B61A38F6D; Tue, 30 Sep 2014 17:16:25 -0700 (PDT) From: "Jim Schaad" To: "'Dan Harkins'" References: <0e3a01cfdcf3$cdca13d0$695e3b70$@augustcellars.com> In-Reply-To: Date: Tue, 30 Sep 2014 17:13:57 -0700 Message-ID: <0e7a01cfdd0c$980c9060$c825b120$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQJrPpFfgr3g/sqefUjDnX1/AEi66wLbbiWIAmGGW/eaubK+IA== Content-Language: en-us Archived-At: http://mailarchive.ietf.org/arch/msg/emu/fxt5P0DTLgEaPeIWVJUbL3ZrevA Cc: emu@ietf.org Subject: Re: [Emu] salted EAP-pwd X-BeenThere: emu@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "EAP Methods Update \(EMU\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Oct 2014 00:16:27 -0000 -----Original Message----- From: Dan Harkins [mailto:dharkins@lounge.org] Sent: Tuesday, September 30, 2014 4:25 PM To: Jim Schaad Cc: emu@ietf.org Subject: RE: [Emu] salted EAP-pwd Hi Jim, On Tue, September 30, 2014 2:16 pm, Jim Schaad wrote: > I can see two problems right off the bat. > > 1. It does not allow me to use a different salted method for > different people so I can upgrade by salt function piecemeal. Sure it does. The EAP-Identity/Response from the client will indicate the identity, the server looks up that identity in the password database, sees how it's salted and responds appropriately. One entry in the database could be SHA-1 and another could be SHA-256. [JLS] Ok - so if I understand this correctly. Server sends a message saying to the client Client returns a message saying to the server. Server looks up dan and says - ouch - that should have been SHA-1 because that password is not upgraded yet. --- I based this comment on the first paragraph of section 2.4 which says: Like all EAP methods, EAP-pwd is server initiated. The server is required to indicate its intentions, including the password pre- processing it wishes to use, before it knows the identity of the client. Thus if the pre-processing is client identity based it would not know this. You might be able to get around this if the client identity in the EAP-Identity message is what is used for the lookup in the database and not the string sent in the EAP-pwd-ID/response. > 2. It does not allow me to do both SASLprep and salting on the same > password. Yes, I see that might be needed if SASLprep was done on the password before it was salted and stored. Given that SASLprep is already a password pre-processing technique (and it is the value 0x02 while "none" is 0x00 preventing the distinction being a low-order bit) I see no choice but to double all the proposed salting indicators, one for SASLprep before the hashing and one for do nothing to the password before hashing. Would that be satisfactory to you? [JLS] It would solve the immediate problem. I don't really care for it as a solution though. regards, Dan. > Jim > > > -----Original Message----- > From: Emu [mailto:emu-bounces@ietf.org] On Behalf Of Dan Harkins > Sent: Tuesday, September 30, 2014 12:02 PM > To: emu@ietf.org > Subject: [Emu] salted EAP-pwd > > > Hello EMU, > > I've had requests to add support for salted password databases to > EAP-pwd. > A newly posted draft does just that: > > http://tools.ietf.org/html/draft-harkins-salted-eap-pwd-00 > > Please take a look and comment. > > regards, > > Dan. > > > > _______________________________________________ > Emu mailing list > Emu@ietf.org > https://www.ietf.org/mailman/listinfo/emu > >