Re: [vwrap] authentication : remove reference to MD5

[Meadhbh Hamrick <[e-mail]>]

but ultimately, the question is, "how much legacy are we willing to
support?" i don't think it was answered here, and i think we really
should make some attempt to address it.

the OpenSim grids and SL use radically similar protocols to do auth
now. if we decided we didn't want to define a protocol with enough
legacy to handle the MD5 based auth, then LL would likely use a
technique that was proprietary. sure, the OpenSim people would reverse
engineer it (i mean, after all, the viewer source is GPL licensed and
pushed out the door with sufficient regularity.)

or we could simply define reverse compatibility as part of the
standard and allow deployers to start the migration on their time
frame.

removing MD5 auth from the spec is a bad idea because it forces people
to deploy proprietary mechanisms to bring their systems in line with
VWRAP when they COULD just as easily do the same thing with an open
spec.

what is definitely a good idea is to add the text "MD5 is provided for
reverse compatibility and should not be used for new implementations"
if it's not there already.

-cheers
-meadhbh
--
meadhbh hamrick * it's pronounced "maeve"
@OhMeadhbh * http://meadhbh.org/ * [e-mail]



On Tue, Apr 6, 2010 at 2:25 PM, Barry Leiba
<[e-mail]> wrote:
>> so if we simply said "we're going to ditch MD5 in favor of SHA256"
>> there would be a problem with reverse compatibility of the
>> authentication data. this is because you can't generate the pre-image
>> from an MD5 MIC and then use it to generate a SHA256 MIC. (or you
>> can't do that in a way that insures that your MD5 pre image is the
>> same as the password.)
>
> The usual way to handle this is with a migration process.  Credentials
> are re-hashed with the new algorithm when they're changed, over time.
> After a time, there's a cutoff and users are forced to change their
> credentials the next time they log in.  The old login has to be
> supported as long as there are users who have not yet changed... or
> until someone decides to toss those users.
>
> Barry
>