Subject: RE: [Ips] Initiator CHAP authentication of target?

From: Julian Satran <[email-masked]>
Date: Mon, 4 Oct 2004 13:40:19 +0200

Marjorie,

Maybe I am not understanding clearly the "substance" of your question but 
if you are questioning the validity of an initiator not using the data 
supplied to authenticate the target - that is "legal" in the sense that 
the protocol has no way of enforcing the check in CHAP (i.e., there is no 
returned value that will irrefutably prove that the initiator did check).
I would not use this protocol in a money exchange transaction! The 
weaknesses of CHAP have been discussed at some length on the list.

Regards,
Julo

"Krueger, Marjorie" <[email-masked]> 
Sent by: [email-masked]
01/10/04 01:28

To
"William Studenmund" <[email-masked]>
cc
[email-masked]
Subject
RE: [Ips] Initiator CHAP authentication of target?

It appears a certain initiator is ignoring CHAP_N returned by the target
and just using the target node name for CHAP_N regardless of what the
target sent in the login sequence.  I think it seems like invalid
behavior but I just wanted to check with this audience.

Thanks
Marjorie

> -----Original Message-----
> From: William Studenmund [mailto:[email-masked]] 
> Sent: Thursday, September 30, 2004 3:32 PM
> To: Krueger, Marjorie
> Cc: [email-masked]
> Subject: Re: [Ips] Initiator CHAP authentication of target?
> 
> On Sep 30, 2004, at 3:22 PM, Krueger, Marjorie wrote:
> 
> > So if
> >
> >>     or, if it requires target authentication, with:
> >>
> >>        CHAP_N=<N> CHAP_R=<R> CHAP_I=<I> CHAP_C=<C>
> >>
> >>     If the initiator authentication fails, the target MUST answer 
> >> with a
> >>     Login reject with "Authentication Failure" status.
> >> Otherwise, if the
> >>     initiator required target authentication, the target 
> MUST either
> >>     answer with a Login reject with "Authentication 
> Failure" or reply
> >>     with:
> >>
> >>        CHAP_N=<N> CHAP_R=<R>
> >
> > And the target replys with CHAP_N that is not defined and the 
> > initiator accepts that (accepts anything) is that valid 
> behavior?  In 
> > otherwords, if the initiator ignores CHAP_N and only uses 
> the target 
> > node name and CHAP_R to authenticate, is that valid behavior? 
> > Shouldn't the target be able to force the use of CHAP_N?
> 
> I'm confused. The initiator can't NOT use CHAP_N. Thus the 
> target shouldn't be able to force something that's required. :-)
> 
> To quote the paragraph after the one above:
> 
>     Where N, (A,A1,A2), I, C, and R are (correspondingly) the Name,
>     Algorithm, Identifier, Challenge, and Response as defined in
>     [RFC1994], N is a text string, A,A1,A2, and I are 
> numbers, and C and
>     R are large-binary-values and their binary length (not 
> the length of
>     the character string that represents them in encoded 
> form) MUST not
>     exceed 1024 bytes.
> 
> So an initiator that just uses the target's name for CHAP 
> purposes seems broken.
> 
> Take care,
> 
> Bill
> 

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips