Date: Sat, 14 Aug 1999 05:43:29 -0700 From: Nick Sayer <nsayer@quack.kfu.com> To: walton@nordicrecords.com Cc: freebsd-hackers@freebsd.org Subject: Re: Whither makefiles for src/crypto/telnet/* ? Message-ID: <37B56471.E6227C20@quack.kfu.com> References: <19990814064443.21756.qmail@modgud.nordicrecords.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Dave Walton wrote: > > If you really want to work on an encrypted telnet, check out The > Stanford SRP Authentication Project (http://srp.stanford.edu/srp/). > I'd love to see SRP integrated into the FreeBSD telnet/telnetd. Again, the problem is that there is administrative overhead - a separate password database is required. It is certainly _also_ a candidate to be included (they can all live side by side), but it does not replace the need that SRA fills. SPK requires a separate database because the server needs to know what the password actually is, not just that the one that was typed is correct. Unix passwords are not suitable because you can't turn hamburger back into steak by running the grinder backwards. :-) When both sides of a conversation have a shared secret, you can assure mutual authentication in a way that is not possible with straight Diffie-Hellman. But Unix passwords can't be considered a shared secret because the server doesn't actually know what the password is. It merely knows when an attempt is correct. A workaround for this is to supply the password salt to the client early in an authentication protocol, then treat the encrypted password as a shared secret. That works, except that more and more unixes are starting to use non-portable crypt() procedures. The client has to have the same crypt() as the server in order for the authentication to succeed. Users with $x salts would not be able to log in from non-FreeBSD machines unless our crypt() was compiled into their telnet. [-- Attachment #2 --] 0a *H R0N1 0 + 0 *H 0050 *H 01 0 UZA10U Western Cape10U Durbanville10U Thawte Consulting1)0'U Thawte PF RSA IK 1998.9.16 17:551604U-Thawte Personal Freemail RSA Issuer 1998.9.160 990630184918Z 000629184918Z0F1 0 UThawte Freemail Member1#0! *H nsayer@quack.kfu.com00 *H 0 =iIڠIHDs蠭s-ﻌ˗粷Qxӳ>g,a+c$% /uU,, ѿ2܊1n|:ѓJN1#f (̔U T0R0 `HB0U 0 U 0 0 U #0>`k3 Xq80 *H gp5} ok<8a' GS=Xf+]4*]9͡Oɱ?^6eF> 04}x44Nmv2xƴpQB^ϑڽz' ?j˘ ܰ[090 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 980916175534Z 000915175534Z01 0 UZA10U Western Cape10U Durbanville10U Thawte Consulting1)0'U Thawte PF RSA IK 1998.9.16 17:551604U-Thawte Personal Freemail RSA Issuer 1998.9.1600 *H 0 ĥ_!}$k kГ$ h,Og CA#0v1P&T( ⸛2< lO5Ov OE`АɜR*56<<5/ 7050U 0 0 U #0rIs4U vr~wƲ0 *H ,ǂ C>i\d+˛P@ºv<@UUy ) W(> X[-3X5vr)BZ w_'ۚ-NҍV eޕSk"z+a^zZ1 0001 0 UZA10U Western Cape10U Durbanville10U Thawte Consulting1)0'U Thawte PF RSA IK 1998.9.16 17:551604U-Thawte Personal Freemail RSA Issuer 1998.9.160 + 0 *H 1 *H 0 *H 1 990814124333Z0# *H 1S88 EƯ0R *H 1E0C0 *H 0*H 0+0 *H @0 *H (0 *H "RHGEk8:fH@vVQhy:ۂfwE\ 8S bnrIbG榐+xȭy%8' +
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?37B56471.E6227C20>