Slashdot Mirror
Delayed Password Disclosure
ET_Fleshy writes "Markus Jakobsson has an interesting article discussing a promising new security protocol called "Delayed Password Disclosure" that can validate a computers authenticity before exchanging passwords/keys. While nothing is ever truly secure, this seems to show promise in protecting users from a wide variety of stealth attacks (pdf) used today, specifically man in the middle (pdf) attacks."
Forgive me for not reading my latest issue of Cryptographer weekly but how on earth is this any different than RSA fingerprints? It looks like the "envelope" and "carbon paper" are just elements of a pre-shared key anyway.
If you know the fingerprint of the host you are connecting to, you are more or less immune from man-in-the-middle attacks. If you have never communicated with the host before, nothing is going to stop a man-in-the-middle - especially if you have to magically share locations of "carbon paper" without the man-in-the-middle knowing about it.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
There are enough people who will give away plain-text password unsuspiciously over the phone or internet.
My bank (and probably many others) will block an account after three consecutive failed authentication, so any guesswork is going to be hard for the bad guys.
Rock that crushes, Paper & Scissors that don't matter.
It'd be better if the font weren't so small, though...
Mutual authentication is nothing new. There exist many mutual authentication schemes that are resistant to man in the middle attacks and also ensure liveness of the exchanges.
The one described here looks to be a simple shared secret method. In may situations, certificate based methods are used in order to avoid the need to securely distribute a shared secret ahead of time.
For a shared secret based mutual auth, why not do the normal thing and pass random numbers and their hashes back and forth, mixed in with the challenge-response sequences needed to establish an authenticated identity, a shared session secret and liveness? Read various EAP drafts or 802.11i or recent 802.16e drafts for real world examples of how to do this. The details necessarily change with the context.
These methods have the benefit of lots of analysis by the crypto community. This delayed password disclosure scheme doesn't seem to have the same benefit.
Evil people are out to get you.
Note that use of encryption software, such as SSH, does not address this problem, since the attacker simply can replace the public keys of the two parties with public keys for which it knows the secret keys. This results in the two parties sharing keys with the attacker, as opposed to with each other; as a consequence, the attacker will be able to read (and even modify) all traffic before re-encrypting it and forwarding it.
And this is why you always share public keys via some other secure means (USB drive, cd, floppy), at least in an ideal world. The article talks about this in regards to someone transmitting data to their bank, however if I am not mistaken SSL(not mentioned in the article) already takes care of this kind of attack. Somehow I doubt any joe user is using SSH to authenticate with their bank :-)
I Am My Own Worst Enemy
Me, i hate pdf...so here's HTML versions, courtesy of Google: man in the middle attack
stealth attacks
Have you seen the arrow?
"One time pads are not the answer."
I wonder if the type of people that came up with 'blink' are now writing new crypto protocols.
I think I'll just withdraw my deposit in gold bricks and sleep on it.
The only part I can't figure out is how they're going to send the carbon paper and envelopes across the Internet. I can't find the protocol for that.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
Why is it called Man-in-the-middle?
Isn't it better if it were called Woman-in-the-middle? It would atleast not make us geeks seem so gay.
Well, feminist do-gooders, in an effort to de-genderify the term whilst keeping the acronym MITM beat you to it, by redefining MITM as "Meet-In-The-Middle".
It was a quite popular term in academia, until it was discovered that "Meat-In-The-Middle" in the context of a three-party situation sounds a lot more gay even.
SCO employee? Check out the bounty
such as SRP?
This basically verifies that the party you are conversing with knows your password, or something about it (i.e. has a salted hash of your password), _before_ you input your password. One could argue that this is more secure than (poorly-implemented) channel security via PKI as a man-in-the-middle would not have access to the accounts hash table unless the target system was compromised.
Interesting, but there are probably a million such things you can do to further tighten security.
Must-not-watch TV!
I'm no cryptography expert, but the secret positions of the carbon paper need to go into "an envelope only Alice can open"- Nowhere in this essay is it explained how this "envelope" is created technologically or how the recipient can interact with it, making the analogy pretty useless (unless I'm missing something). Also, it says that SSH doesn't help with man-in-the-middle attacks, but a third party signing agency, I believe, solves that problem, from what I understand. This "envelope" sounds suspiciously how quantum cryptography works- Is this just an explanation of "quantum cryptography" without mentioning "quantum cryptography"? I'm confused...
Joined the Rock Paper Scissors Tournament yet?
Too complicated, let's just play.
Rock.
My bank (and probably many others) will block an account after three consecutive failed authentication
This is a big hole for denial of service. Try purposely logging into the bank CEO's account with a bad password, and see how quickly the policy is changed.
What the world does not need is another generalized mutual authentication method. These are used to place a veneer of security on a generally insecure thing.
E.G. Credit card transactions over the internet. These are protected by SSL/TLS. This is somewhat removed from the credit card transaction itself, instead protecting the link rather than the transaction. So you log onto vendorX's web site and use certs with SSL/TLS to protect the link. You feel conforted by the little lock icon in the corner of your screen and proceed to hand VendorX all the details needed to drain arbitary amounts of money from your credit card.
Instead.. Protect the transaction directly, with something like a secure credit card transaction protocol. VendorX doesn't need your credit card details, he needs your money. The security protocols should run between you and the vendor to establish a transaction and the vendor's identity, between you and your credit card company to authorize a payment against the transaction to VendorX and between the credit card company and VendorX to transfer the payment.
VendorX gets the money, not a blank, signed cheque.
Repeat exercise for all activities you need to secure, applying appropriate measures for the situation. Leave SSL/TLS for securing the link, not the application.
Evil people are out to get you.
Could someone explain to me how you implement carbon paper, "magic envelopes" and invisible ink inside of a computer? seriously...
Also, it seems like you could come up with an algorithm to make password guesses based upon the numbers that were returned...trying different values that add up to zero. Or would this take too long?
X.509 Certificates have been known for ages. There's nothing to see here. Please move along.
And he is me, appearently
;-)
You take it in both ends then AC? I respect your i/o capabilities
Holy crap that is some seriously large text!
The article describes a (new?) challenge-response authentication algorithm.
This is a little like the interlock protocol, without the public-key cryptography. But this instance has the serious disadvantage that the server side must know the user's unencrypted password (or equivalent) to play the game. That is a very bad thing - it has been empirically demonstrated that users will resue their passwords, so any authentication database that keeps them in the clear is a high-value target for attackers.
BTW You are quite safe from MITM attacks when using SSH if you use ssh protocol 2 and public key authentication. The public key signature checks are bound to the results of the Diffie-Hellman key exchange that occurs at the start of the protocol. In the case of a MITM, these DH results will be different for the client->MITM and the MITM->server legs, so the real server will refuse to accept the signature that the client presented to the MITM and the authentication will fail.
This proposed scheme does nothing to prevent a man in the middle attack. For example, if a person is trying to log in to a server, they would wait for the server to prove it knows their password before actually sending the password. But the man in the middle attaker could obviously just start a login attempt at the real server to get the appropriate hash of the user's password. But since anyone can get this hash, where is the security?
Mutual authentication sounds safe and warm. Alice know Bob is at the other end Bob knows Alice is at the other end.
However this is the situation after you have performed the mutual authentication, not before. In all protocols I have seen, this takes place in some order. In order for Alice to authenticate Bob's identity and the other way around, with both exchanges bound together (so differentiating from bilateral authentication), Either Alice or Bob has to first reveal their identity so it can be authenticated. This includes the proposed scheme.
This asks the question "Who goes first". Usually the protocol forces this issue and leaves one side or the other in the disavantageous position of identifying themselves first. This is analagous to the gatekeeper shouting "Halt! Who goes there?" to someone trying to enter. The person trying to enter is forced to go first and reveal themselves.
I may not want to reveal my identity to anyone, especially when it comes to say, wandering around in public with a wireless device. All sorts of tracking mechanisms become possible.
What we want is a "Who goes first protocol" so I can enforce my own policy on revealing my identity. If someone wants to sell to me, they had better go first. If I'm trying to get through a door, the building owner can reasonably expect me to go first. There are plenty of situations where a network may want to only reveal its identity to people who are allowed to know its identity, and noone else.
We already have the algorithms, but the protocols are stuck in the mud and prevent us from moving forward with security that offers more than what SSL gives us.
Evil people are out to get you.
This article looks like the paper you would find on your desk the first day of 'security 101' class. As others have stated, nothing new is offered here, the conceptual model presented is not detailed yet flawed none the less, and the font size is the icing on the cake of annoyance.
By then, it may be too late, as in the meantime, the attacker may collect and even modify information that was not intended for him.
Damnit, Bones I, can't figure out how to, place commas in, my, sentences I know they, should go somewhere I'm. Just not sure where.
https://www.eff.org/https-everywhere
I believe it is called "Pegging".
t ice).
http://en.wikipedia.org/wiki/Pegging_(sexual_prac
So nobody technical can tell if they've really done anything new or interesting, or if they've just done Yet Another Variant on mutual authentication that doesn't offer any advantages over existing techniques. MITM attacks aren't new, and needing twoway authentication for some applications isn't new, and using stolen passwords to crack machines isn't new, and using cracked machines to do Bad Things with isn't too new, though the popular approaches to cracking Windows machines don't usually bother with MITMing passwords because there are so many other back doors available. So what's new here?
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
... has solved this problem more than 6 years ago. And it does not require the password to be stored in clear-text by the server. (although, "with a little thought", according to the article, neither does this scheme. BAH! Proof is left as an excercise for the reader)
Stick with something that has been rigorously reviewed, and proven over a period of time. And something that can be explained simply, in terms of the actual technology, rather than resorting to pathetic analogies that do not explain anything!
SRP
I realize this is a joke, but people reading should know that meet-in-the-middle is indeed a type of cryptographic attack. It has nothing to do with man-in-the-middle, which attacks a protocol instead of a cryptographic algorithm.
Microsoft files patent application for delayed password protection. Company then decided not allow anyone to use this patent and support bill gates plan to end use of passwords with biometrics.
the problem here is that a webpage is not data but also program (i.e. javascript).
Alice could log in to the fake bank, and not realize that instead of doing the magic password trick, she's sending her password in plain text. Why? Because at the moment, the password encryption is (putting SSL aside) implemented by javascript!
To be safe, a key encryption algorithm would need an established software running it (in this case, the web browser).
This means:
a) having a W3-approved algorithm to be implemented in browsers, or
b) Having downloaded specific software by the bank (i.e. bankOnline browser(TM) or something).
Now even the nearsighted can learn about securing their Beowulf Clusters! (I'm myopic too so don't hurt me now.)
Seriously, even after RTFA, especially the last part that actually describes the proc in the first place, it's a bit hard for me to understand. I know it involves the server knowing what places the actual password resides within the user's "password" transmission...right?
You can hold down the "B" button for continuous firing.
So I actually got this sent to me this morning, accompanied with some nice snarkiness about "known plaintext handouts".
a af t-ncs021405.php
http://www.eurekalert.org/pub_releases/2005-02/
Hmm. It's basically Kerberos, except totally broken.
So we don't actually know how this protocol works, but the description at the above link is vastly more coherent. (Anything with "magic envelope" and "this is a metaphor" really shouldn't be taken as a protocol specification.)
===
CUSTOMER: Bank, I will send you some information that is encrypted. You can only decrypt it if you know my password. If you don't know the password, you could of course try all possible passwords (although that is a lot of work!), but you would never know from my message if you picked the right one. Once you have decrypted the message, I want you to send it to me. If it is correctly decrypted, I will know that you know my password already. Once I know that you know my password, I will send it to you so that you can verify that I also know it. Of course, if I am lying about my identity and don't know the password in the first place, then I will not learn anything about the password from your message, so it is safe in both directions.
===
It's also wildly exploitable. Here's how:
First of all, password brute forcing? Alot of work? Only if there's no way to execute an offline attack, i.e. you can run attempts as fast as your own computer can calculate them. What we need is an offline attack -- something that lets us try to try as many attempts as possible. The most important thing is verifiability -- we need to know when we guessed the actual password.
Can we possibly verify our guess? Well, Alice sends the bank some random data, which is dutifully returned to Eve. Eve sniffs this traffic, and now has a very simple task:
Guess all possible passwords the bank could have used to decrypt the password. When the content from Alice, decrypted with the guess, equals what came back from the Bank, Eve has found the password.
But then there's Eve's friend Mallory, who thinks Eve isn't ambitious enough and wants to steal anyone's password at the bank, not just Alice's. Suppose Bob has angered her somehow. Mallory can't sniff Bob's traffic, but then, she doesn't actually need to. Mallory can simply blindly provide some arbitrary data to the bank. It's garbage going out, but even garbage will decrypt into something. Unless the bank specifically has users provide some known plaintext in the outgoing data, it's going to "decrypt" that noise, using the password, into more noise.
Once again, outgoing data + bank password = incoming data. Mallory gets to do offline attacks too -- but against any user she wants.
Of course, the bank *could* put some sort of verifier in the message that Alice sends to it. But then Eve has an even easier time guessing passwords, since she just tries random passwords until the verifier is unveiled. No need to sniff the traffic back from the Bank (which is actually significant -- it means Mallory could firewall off the bank and still successfully participate in the auth protocol, with no way for the bank to find out.)
Anyway, long story short, broken. Really, really broken.
--Dan
I'm a novice ssh user, and I'm a little unclear on man in the middle and if this carbon-copy technique will benefit? For example, my debian box got a new dhcp address after being powered off from a power outage, I ssh'd into it and Putty alerted me that it had a new signature (I assumed because of the new IP address). Will this technique benefit me by creating a carbon copy in addition to looking at the signature before I log in? It's probably my own fault because I never created and shared my own keys; I recall something about creating my own key, then entering that key into Putty, but it's escaped me. Does anyone have a good easy procedure to run if I ever get a notification that my hash signature has changed? A little extra protection sounds good especially if I'm connecting outside the confines of my LAN.
Namaste
Hello,
I came across this posting and thought it was very interesting. I have a question about it though (I'm not a security expert so please forgive my ignorance if the answer escapes me).
It seems that an intruder can still impersonate the bank if he carefully selects the numbers. If he can correctly select a set of numbers such that they add up to zero, then Alice will believe he is the bank. So it seems the problem is selecting a set of zero-summed numbers, right?
What if the intruder were to select all 0's in every position of the "letter" except one, the last column? In the last column, the intruder places a 1 in the "top" position and sends the letter back. If the last digit is a 1, then the set of numbers (0+0+0+...+0+0) will not include the 1 and they will sum to 0 implying that this is the bank. Alice will willingly give her password away then, correct?. However, if the last digit is a 0, then Alice does not give her password, in which case the intruder can place a 1 in the "bottom" position and send the letter back. This time, Alice will not include the 1 in the top position and the set of numbers will sum to 0, making Alice believe the intruder is the bank.
Does that all seem to make sense? Where does my understanding depart from the truth?
Your help appreciated,
Kane
The proposed solution does not really differ from exchanging hashes of challenges and preshared secrets. Further, the article is badly written; e.g. it explains (or tries to explain) how a standard denial of service attacks requires the attacker to establish a very large number of connections to the victim even though this is totally irrelevant to MITM attacks discussed throughout the reminder of the article. Author confuses SSH with SSL/TLS (on purpose?) then goes on to say that MITM attacks can be used to [...] disrupt key exchange operations. I don't understand how authenticated Diffie-Hellman key agreement or SSL/TLS pre-master secrets fail to deliver key exchanges in this context. Anyone?
First of all, we already have protection in protocols such as SSH and SSL against man-in-the-middle attacks. Thus, the paper's whole reason for existence disappears.
Secondly, the security of this "masking" technique depends upon the randomness of the numbers chosen by the server (and, by implication, any man-in-the-middle). I could send a packet containing all zeroes and it would guarantee to sum to zero after applying any mask at all. How does the receiver judge whether the numbers passed are sufficiently random?
Before i rtfa, i thought this had links to the MS UndeadTAPI "PASSPORT for the beyond" i.e. a triggered email discloses your passwords in order to circumvent your family having to sue for disclosure. Next up in UndeadTAPI is auto-distruct pr0n (in XML).
I guess his Mom never told him it was rude to shout, or to use MS-Word for editing HTML.
Unlimited growth == Cancer.
It was a quite popular term in academia, until it was discovered that "Meat-In-The-Middle" in the context of a three-party situation sounds a lot more gay even.
There's another rendering of MITM that gets thrown around occasionally: "Monkey in the Middle".
It doesn't sound gay.. but it does sound a bit, um, different.
"With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
RFC 1925
You know you're a victim of a MITM attack, if
a. Font size dramatically increased
b. Article content turned into nonsense
c. Both
Can anyone give an idea how often things like man in the middle attacks actually happen? I know it is possible, but it seems quite unlikely that anyone would go through the trouble when there are so many easily hacked things out there whether it is known exploits or just unencrypted links. The only way I can see it happening is if you were a target for a particular reason such as corporate espionage.
Has anyone here at slashdot actually been the victim of a hack as sophisticated as man-in-the-middle on an otherwise encrypted link? I'm curious.
-matthew
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
I'm suspicious of this just because they lump so many different scenarios into one category.
#1. Zombies
#2. Man in the middle
#3. Traffic analysis
#4. "email-cluster-bomb attack"
#5. "incorrectly update routing tables"
And so forth. Of what possible use would authentication be with a bunch of zombies? If a zombie is an example of a "stealth" attack, then what would be an example of a non-stealth attack?
Anyway, if Alice and Bob (might as well use the common ID's) both have access to the password, why not simply use authentication and encryption as Bruce Schneier covers in "Practical Cryptography"?
Authentication and cryptography aren't that difficult to understand.
In fact, in his scenario (Alice and Bob both have the password and it hasn't been compromised), encryption/authentication is super easy. Again, it's covered in Bruce Schneier's book "Practical Cryptography".
I see one obvious and major flaw to this approach. A 'man in the middle' can easily respond to the client (Alice) with all 0's. Regardless of the 'carbon paper' mask that is used, all 0's always add up to 0 (which will make the imposter appear valid).
Alice seems pretty gullible.
ps. I developed a little encryption scheme to be used between a hardware firewall and client a little while back (the hardware firebox is called a 'WazerBox'). It has since been altered but this paper describes the basics. I believe it is relatively secure but would love someone to prove me wrong.
Of course, you could always use S/Key or OPIE and have what is essentially a one-time password system.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I'm guessing that it relies on some kind of homomorphic public-key cryptosystem (homomorphism: when Encrypt(t1) op Encrypt(t2) == Encrypt(t1 op t2)).
Ergo, Alice (customer) sends Bob (bank) a public key and some kind of nonce encrypted with said public key. Bob performs some kind of homomorphic operation involving the hash of Alice's password, and returns the result (ie Bob does some kind of mathematical operation on Alice's nonce without actually needing to decrypt it in the first place).
Using some kinda expansion function (each bit of the hashed password is substituted by a number of random bits) would probably combat any kind of adaptive attack against the server.
(And can everyone stop nominating SSL as a 'better' solution: SSL relies on PKI (which is about as safe as DNS when it comes to 'authenticating' the other end)).
They can send it to my bank account number
And if they know your bank's routing number (public information; just ask the bank) and your account number, not only can they direct deposit, but they can also take arbitrary money from your bank account using a fraudulent direct debit. I have had this happen to a family member twice; after the second incident, she canceled her checking account and got a new one with a different number.
give me a check, send me US Postal money orders ... or give me cash
What happens when the only bank with branches in town isn't your bank? Then how do you deposit your cash, check, or money order in your bank account? For example, I lived in Terre Haute, Indiana, for four years when I was in college, and during those four years, First Financial Bank was the only bank in town. I didn't set up an account with First because their web site worked only with IE, while Bank One (the bank I had used back home) had no problem with Mozilla even pre-1.0. Besides, to send you a check, the sender still needs an address.
give me a credit card number (and appropriate data) that I may use
How much does a merchant account cost again? Are they even available to individuals?
The only account that I should ever need anyone to know to send me money is my PayPal account...
The PayPal public/private model is the model I was considering. Someone with your PayPal account name can only push money to a PayPal account; only someone with both name and password can pull it.
Use SRP, B-SPEKE, or any of the other hundreds of variations of secure password authentication that have been invented.
According to the metaphor, we have a magic envelope that only one person can open. Forget the rest of the scheme - just use the magic envelopes.
There is absolutely no worthwhile content in this article. It begins by spreading FUD about using HTTPS. It then creates a metaphor of a very basic challenge-response method. The author writes as though s/he has never heard of CRAM-MD5.
I found the article's lack of a byline or references to prior papers published on the topic of so-called "stealth attacks" quite telling. This is an elementary paper written by an amateur.
Grade: C-
That web page is a rambling, disorganized mess--the author should take a writing class.
Can't the impersonator just pass all zeros, so that any summation would yield 0, or something similar?
The power of Christ compiles you!
Sorry if I'm being totally naive about cryptography. But if I wanted to verify a host's identity by whether he knows my password or not, why can't I do something like this:
;) this seems rather simple to implement and as far as I can tell addresses most of the possible attacks, no? An attacker that would try to guess Alice's password using the encrypted key would have to contact Bob a lot to verify if the key is correct which could be dectected I think.
Alice: Hi! I'm Alice.
Bob: Hi! Here take this randomly created key that will be used to encrypt our session. This key is encrypted by your password. For the remainder of the session you will need this key to successfully communicate with me.
Alice: Thank you. I will now decrypt this key and use it. If either one of us didn't know the password this will not result in successful communication.
Apart from being very polite
To prevent an attacker from guessing the password by trying to decrypt some captured traffic whose plaintext content is at least partially known (if this is email-traffic look for HELO or some other known part of the protocol) you just add another step where the first thing you do is a Diffie-Helman exchange encrypted by the session key and then us that key to actually encrypt you traffic.
Did I miss something? Why would you not want to do it like that?
If you read the other papers this professor has written, a lot of his stuff is about being anonymous. Look at his e-commerce/e-cash stuff and you will see. I get the impression that he has more in mind for this than just banks and its customers. I think he is looking for ideas on how you can trust someone you have never "met".
Hello!
I found exploit of this auth method.
Sorry for my English. Here i will try to describe how a hacker can feign a realy host. It's easy...
For example. Host A - real site which knows a password. Host B - user. Host C - faked host. User B connects to host C thinking that he connects as to host A. What is host C doing? It gets a crypted phrase from host B and forwards it to host A as a client B. Host A gets a phrase and thinking that phrase was gotten from B. It can decrypt it and sends a decrypted phrase to user (faked host C). Host C gets a decrypted phrase and forward it to host B. The host B gets a decrypted phrase and thinks that host C real authorized host A (bank for example).
The END. The faked session between host B (user) and host C (hacker site) is opened.
If i don't understand the idea of authors please correct me. But i think that this will work.
Best regards, Alexey Zvyagin aka Perlover