Re: [saag] Improving the CHAP protocol

Hi,

I fully agree that it should have been done a long time ago and that it will take a very long time to achieve. To me that just means we need to start as soon as possible.

When it comes to crypto profiling, IETF is often very slow and very focused on whether some system will continue the weak algorithms in questions. For an example take the otherwise excellent RFC 7525 that has several super soft statements like:

"Curves of less than 192 bits SHOULD NOT be used."

I have met several implementors in different companies that read "SHOULD NOT" as "NO REASON TO CHANGE ANYTHING".

I think IETF in general need to be much more pro-active when it comes forbidding weak algorithms and also use much more "MUST NOT".

Cheers,
John

-----Original Message-----
From: saag <saag-bounces@ietf.org> on behalf of Alan DeKok <aland@deployingradius.com>
Date: Sunday, 22 September 2019 at 15:51
To: Yoav Nir <ynir.ietf@gmail.com>
Cc: Security Area Advisory Group <saag@ietf.org>
Subject: Re: [saag] Improving the CHAP protocol

    On Sep 21, 2019, at 1:56 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:
    > 
    > FIPS is one advantage. The other is that MD5 is getting scarce in crypto libraries, while SHA-256 is everywhere.  Not everything is devices — there’s still software out there.

      MD5 will be used forever.  As will MD4.  Crypto library authors can complain, but the market has spoken.

      Every end user device ships with support for CHAP (using MD5) and MS-CHAP (using MD4).  These protocols are widely used as part of 802.1X authentication.

      The EMU WG spent years standardizing TEAP (RFC 7170, May 2014), which is only getting implemented now (!).  That method could have forbidden the use of insecure methods such as EAP-MD5 (CHAP) or EAP-MSCHAPv2.  It did not.  Even if it had deprecated MD5 / MD4 methods, no one implemented TEAP.

      In the mean time, people have been using EAP-TTLS and PEAP as "de facto" standards.  Which use MS-CHAP and/or CHAP.  The use of MD5 / MD4 is inside of a TLS tunnel so it's not all bad.  But the usage still makes it difficult to remove MD5 / MD4 entirely.

      It may take 3 years to get a new standard which deprecates the use of MD4 / MD5 in authentication methods.  It will then take another 10 years before the new standard is wide-spread.  Only then can these insecure authentication methods be disabled on authentication servers.

      I see deprecating MD5 / MD4 as "pie in the sky" wishful thinking.  It's definitely *required*, but entirely *impractical*.  Crypto libraries *will* ship with them for the next 15 years.  If they are removed from crypto libraries, vendors will add their own MD5 / MD4 implementations to every end-user device.

      If we wanted to fix this, we should have been done it years ago.  Maybe we can start the process now.  But to be realistic, I will be in retirement long before MD5 / MD4 are removed from common usage.

      Alan DeKok.

    _______________________________________________
    saag mailing list
    saag@ietf.org
    https://www.ietf.org/mailman/listinfo/saag