Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:13:58
Daniel R. Oelke (Dan.Oelke@aud.alcatel.com)
Wed, 9 Sep 1998 16:37:15 -0500
I am trying to find a protocol that will work in the following
situation. I'm well aware of some potential weaknesses, but the
threat I have treats these as acceptable. (threats like
using playbackable username/passwords)
Alice logs into computer system A. She executes a command on
comptuer system A that is to transfer a file to (or from) system B.
System B needs to be able authenticate Alice with no additional input
from Alice. i.e. like being able to do an rcp command. To be
able to do this, Alice must have the same username/password on
both systems. System A can then send the username and some type
of authentication info to system B.
Computer system A & B use a traditional username/password system
of authentication. The passwords are stored in a database as one-way
hashes with salt. System A will usually have a different salt value
from System B (seperate databases).
Since system A & B have different salts, the hash values will be
different on both systems. So, the only way to send authentication
info to B would be to keep in RAM Alice's cleartext password so it
can be hashed with B's salt value prior to sending to B. I don't
like this idea for obvious reasons.
Another solution would be to have a common user database, but
other system requirements have ruled this out.
Another solution is to store and send the passwords always in
the clear, but this is very scary and a problem in
my threat model.
So, any other ideas or pointers into Appliced Crypto on how I can
do the authentication without common databases, or cleartext
passwords being stored in RAM.
Any and all help would be appreciated.
Thanks,
Dan
--------------------------------------------------------------------------
Dan Oelke - droelke@aud.alcatel.com Alcatel Telecom, Richardson, TX
"You will see something new. Two things.
And I call them Thing One and Thing Two." - The Cat in the Hat
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:13:58