From owner-freebsd-security Mon Jun 3 16:44:54 1996 Return-Path: owner-security Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id QAA28521 for security-outgoing; Mon, 3 Jun 1996 16:44:54 -0700 (PDT) Received: from halloran-eldar.lcs.mit.edu (halloran-eldar.lcs.mit.edu [18.26.0.159]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id QAA28514 for ; Mon, 3 Jun 1996 16:44:53 -0700 (PDT) Received: by halloran-eldar.lcs.mit.edu; (5.65/1.1.8.2/19Aug95-0530PM) id AA30637; Mon, 3 Jun 1996 19:44:35 -0400 Date: Mon, 3 Jun 1996 19:44:35 -0400 From: Garrett Wollman Message-Id: <9606032344.AA30637@halloran-eldar.lcs.mit.edu> To: Will Brown Cc: freebsd-security@FreeBSD.org Subject: Re: MD5 Crack code In-Reply-To: <199606032245.SAA02583@selway.i.com> References: <199606032245.SAA02583@selway.i.com> Sender: owner-security@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk < said: > To be painfully pedantic, an FTP client (say) with Skey knowledge > would observe the challenge (as opposed to normal login:), request the > secret seed password from the user (user sees "password:") generate > the one-time password using this info and complete the > authentication. To the user it looks EXACTLY like a "normal" login. Well, actually, you want to make it possible for the user to use her own calculator as well in case she is running the client over an insecure remote login. (E.g., when I deposit files from my development machine on freefall, I need to run the calculator on my desktop machine, not the (network-connected) development box.) The IETF is developing a follow-on to S/Key called ``OTP''. I don't know what state it is in right now, but I would hope that they are specifying standard mechanisms to communicate this information over TELNET and FTP connections. > The problem is that there are no Skey clients, just as there are no > SSL (or other crypto) clients, for all platforms. There are clients for Macs and PCs running DOS or Windoze. Those are the only real significant potential problem sources in most organizations... -GAWollman -- Garrett A. Wollman | Shashish is simple, it's discreet, it's brief. ... wollman@lcs.mit.edu | Shashish is the bonding of hearts in spite of distance. Opinions not those of| It is a bond more powerful than absence. We like people MIT, LCS, ANA, or NSA| who like Shashish. - Claude McKenzie + Florent Vollant