Re: [saag] Improving the CHAP protocol

[Peter Gutmann <[e-mail]>]

Alan DeKok <[e-mail]> writes:

>In the mean time, people have been using EAP-TTLS and PEAP as "de facto"
>standards.

Yup.  Doesn't matter how bad the auth protocol actually is because it's
tunneled over TLS everywhere where it matters.

>I see deprecating MD5 / MD4 as "pie in the sky" wishful thinking.  It's
>definitely *required*, but entirely *impractical*.

Definitely.  And that's why I proposed having the replacement RFC titled as
"FIPS compliance for CHAP", because moving to SHA-256 won't make it more
secure, it'll just make it more FIPS compliant.

Having said that, if you're going to go with a breaking change in CHAP, you
may as well actually fix CHAP rather than just making the hash function FIPS
compliant.  There's a rather nice mutual auth protocol from Kaufman, Perlman,
and Speciner which is something like:

Challenge ->
<- Enc( Challenge )
Enc( Response ->

using the universally-available AES, so the whole protocol is two crypt
operations on each side.  It's one more message than CHAP, but provides mutual
auth in the process.  Downside is that for low-entropy keys/authenticators
it's open to a brute-force attack, but it is a starting point.

Peter.