Re: [vwrap] authentication : remove reference to MD5

we need clarification about how much of the second life legacy
protocol will be used in VWRAP.

for instance. second life stores the MD5 hash of user passwords in the
user database and uses it to authenticate users when logging in.

but MD5 has some significant problems which were exacerbated several
years ago when there was a security breach of linden's servers.

so if we simply said "we're going to ditch MD5 in favor of SHA256"
there would be a problem with reverse compatibility of the
authentication data. this is because you can't generate the pre-image
from an MD5 MIC and then use it to generate a SHA256 MIC. (or you
can't do that in a way that insures that your MD5 pre image is the
same as the password.)

so in other words, there is an action we could take in this group that
COULD make it very difficult for linden and presumably existing
OpenSim instances to use the authentication protocol.

so the question is, to which degree do we add an engineering burden to
existing implementations that would like to adopt this group's output?
the question of the two string identifier is a good one. linden could
probably make systems that adhere to all sorts of different changes.
but to what degree to we make it easy for existing implementers vs.
the desires of people who have yet to build and implementation?

-cheers
-meadhbh

--
meadhbh hamrick * it's pronounced "maeve"
@OhMeadhbh * http://meadhbh.org/ * OhMeadhbh@gmail.com

On Tue, Apr 6, 2010 at 11:01 AM, Peter Saint-Andre <stpeter@stpeter.im> wrote:
> On 4/6/10 8:19 AM, Meadhbh Hamrick wrote:
>> okay.
>>
>> if we're going to remove VWRAP from all current implementations,
>
> What does that mean? I thought we were trying to build VWRAP into
> implementations, not rip it out. :)
>
>> i
>> vote we remove MD5 from the auth spec and replace it with a MIC with
>> better security properties, like SHA224 or SHA256.
>
> +1 to more secure authentication.
>
> My quick reading of the authentication draft led me to think that it
> needed a thorough review, but unfortunately I haven't had time to do
> that yet.
>
> Peter
>
> --
> Peter Saint-Andre
> https://stpeter.im/
>
>
>
>
> _______________________________________________
> vwrap mailing list
> vwrap@ietf.org
> https://www.ietf.org/mailman/listinfo/vwrap
>
>