[5008] in Kerberos
Re: Secure telnet/PPP/Kerberos/STEL/... (was Re: STEL: Secure TELnet -- Call for Beta Testers)
daemon@ATHENA.MIT.EDU (Planar)
Fri Apr 21 11:12:17 1995
To: kerberos@MIT.EDU
Date: 21 Apr 1995 14:22:51 GMT
From: Planar <Damien.Doligez@inria.fr>
In article <Pine.SUN.3.91.950420060653.5096D-100000@kerby.ocsg.com>, Joe Kovara <joek@kerby.ocsg.com> writes:
>Well, since I've got a secure channel, why not send my password? Ok, who
>goes first? If you're talking to a bad guy, whoever goes first has just
>given away their password. This does NOT imply that the host has already
>been compromised. It simply means that someone has been able to fool you
>(using DNS/IP spoofing) into talking to them instead of the real host.
But the solution to this problem is given in Schneier's book (and
other places as well, I would expect):
First, I'll commit to my password by sending MD5(password+session key).
Then the other guy will do the same with his password.
Then I send my password and the other guy sends his. If the hashes
don't match, then I know there's a man-in-the-middle attack going on.
No need for token-based authentification, here. The good old password
system still works.
--
Planar
P.S. What's the need for such looong message-IDs ? I guess some
programmer got lazy. Or is it some kind of subliminal channel ?
