From owner-freebsd-hackers Sun Feb 26 16:03:34 1995 Return-Path: hackers-owner Received: (from majordom@localhost) by freefall.cdrom.com (8.6.9/8.6.6) id QAA12269 for hackers-outgoing; Sun, 26 Feb 1995 16:03:34 -0800 Received: from moondance.np.ac.sg (moondance.np.ac.sg [153.20.24.69]) by freefall.cdrom.com (8.6.9/8.6.6) with ESMTP id QAA12257 for ; Sun, 26 Feb 1995 16:03:29 -0800 Received: (from uucp@localhost) by moondance.np.ac.sg (8.6.9/8.6.9) id HAA24839 for ; Mon, 27 Feb 1995 07:51:38 +0800 Message-Id: <199502262351.HAA24839@moondance.np.ac.sg> Received: from titan.np.ac.sg(153.20.24.72) by moondance.np.ac.sg via smap (V1.3) id sma024836; Mon Feb 27 07:51:16 1995 Subject: Re: key exchange for rlogin/telnet services? To: jkh@freefall.cdrom.com (Jordan K. Hubbard) Date: Mon, 27 Feb 1995 07:57:55 +0800 (SST) From: SysAdmin - Ng Pheng Siong Cc: hackers@FreeBSD.org, security@FreeBSD.org In-Reply-To: <199502261913.LAA29658@freefall.cdrom.com> from "Jordan K. Hubbard" at Feb 26, 95 11:13:06 am X-Mailer: ELM [version 2.4 PL21] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Content-Length: 1480 Sender: hackers-owner@FreeBSD.org Precedence: bulk > You know the problem. You're sitting down at USENIX or your friend Bob's > in Minnesota or some other gawdforsaken place and you have no way of knowing > whether or not that password you just typed to log in to freefall was just > sniffed by the entire undergraduate class of the local university (or their > bored ISP). You can't set up a kerberos realm with everyone, so what you'd > really just like to do is ensure that the endpoints are reasonably secure > and encrypt everything going in between. A friend recerntly suggested a > method for which my knowledge of the spelling may be incomplete, but > I'll try: "Diffie-Hellman key exchange." Apparently you start out with > a key pair on each end and then each raise eacy to the power of the other's > public half and used the information derived to secure the link. Correct spelling. ;) Check out David Safford's SRA (Secure RPC Authentication) telnet/ftp, which use D-H to exchange a key to encrypt your password with. There is a paper in one of the Usenix security symposiums. URL: ftp://net.tamu.edu/pub/security/TAMU Note that D-H key exchange is patented in the US (till 97?). Note 2: the telnet/ftp do not encrypt the entire session, just the password exchange. For that, you may want to check out swIPe. (I think swIPe may be in NetBSD, or has an implementation on it, or something like that.) - PS -- Ng Pheng Siong * lsys@np.ac.sg * ngps@np.ac.sg Computer Centre, Ngee Ann Polytechnic, Singapore