Re: Logon protocols

From: Keith W. McCammon (km_at_km.com)
Date: 06/13/03 

Date: Fri, 13 Jun 2003 11:29:04 -0400

> So when a user tries to log in, the client sends their
> username and a hash of their password to the DC?

Using NT, yes. A hash would be generated by the client and sent to the *DC.
If there was a match, then the user was authenticated. Pretty standard
system.

> Is this suseptable to a replay attack?

In theory, yes (NT only), although you wouldn't really even need to go to
the trouble. You could sniff the hash off the wire, run it through
L0phtcrack, and then just log in as the user.

Kerberos, on the other hand, uses a significantly more secure scheme, the
details of which are available elsewhere, and are too complex to outline
here. Suffice it to say that it is a time/ticket-based system that would be
quite difficult to replay.

Relevant Pages

  • Re: Custom Authentication with WSE 2.0
    ... Get the Client to hash the password before sending the password over. ... Based on the custom handler in web.config Wse instantiates the custom ... to encrypt the passwords (the username for example), so that way I can come ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: PasswordOption.SendNone
    ... the client sign or encrypt the HASH of the message with ... The Message together with the Ciphertext ... is then sent over to the WS together with the username. ... client) from a database or whatever storage medium you have...(This model ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: PasswordOption.SendNone
    ... the client sign or encrypt the HASH of the message with ... The Message together with the Ciphertext ... is then sent over to the WS together with the username. ... client) from a database or whatever storage medium you have...(This model ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Logon protocols
    ... >> username and a hash of their password to the DC? ... A hash would be generated by the client ...
    (microsoft.public.win2000.security)
  • Re: Socket Server with Encryption help
    ... After reading your post I got a very strong suspicion that regardless of your saying that you read "a lot of papers about Symmetric, Asymmetric, Hash, Envelope and Signature" you didn't read even distantly enough to be able to implement something even distantly secure. ... The classical paper on three party authenticated protocols design was written by Needham and Schroeder "Using encryption for authentication in large networks of computers" in 1978, where they described several protocols, one of witch was modified, strengthened and extended a bit later to become what is now known as Kerberos. ... I've started to develop a server and client socket classes with encryption. ...
    (microsoft.public.dotnet.security)