Idea for secure login

From: Paul Johnston (paul_at_westpoint.ltd.uk)
Date: 06/14/03 

Date: 14 Jun 2003 10:00:08 -0700

Hi,

I just wondered if this login scheme had been considered before and
what the verdict was.

I have already used a challange hash authentication protocol for web
logins. The client and server have the password as a shared secret.
This works ok, but the password has to be securely exchanged in the
first place.

But, you can use the non-reversible property of secure hashes to avoid
the need to exchange a password. When creating the account, the client
sends the server:

  md5(hmac_md5(password, random))

Now, to login the client sends:

  hmac_md5(password, random), md5(hmac_md5(password, random2))

The first part proves the client knows the password - an eavesdropper
can't reverse the md5 and calculate this. However, they could now
perform a replay attack, so the second part sets a new login secret.

I realise this scheme fails completely if the attacker is not just a
malicious eavesdropper, but can modify packets in transit, etc. That
is not a problem to be because I am implementing this with JavaScript
that is downloaded insecurely, so I can never get around an active
attacker.

Does it work?

BTW, you may be interested in my JavaScript MD5 implementation
http://pajhome.org.uk/crypt/md5/

Regards,

Paul

Relevant Pages

  • RE: Penetration test of 1 IP address
    ... It does not look like the login screen found on the ... Penetration test of 1 IP address ... "I have been asked to perform a security audit of 1 IP address for client." ...
    (Pen-Test)
  • Re: Windows Login
    ... perfect...no public DNS servers used internally at all. ... We manage several hundred client networks. ... Windows XP desktops, Exchange 2003, WSUS deployments SQL, etc. ... CTRL-ALT-DEL, select Logoff, and RE-login, and they can login ...
    (microsoft.public.windows.server.setup)
  • Re: svchost.exe
    ... it boot, login, start task manager and after about 10 mintues svchost.exe ... winmgmt, wscsvc, wuauserv ... So I gave my PC a static IP and disabled DHCP client and DNS client ... ShellHWDetection is needed or bootup and login take 5 minutes. ...
    (microsoft.public.windowsxp.general)
  • RE: Penetration test of 1 IP address
    ... regards to carrying out the actual testing phase of the engagement so I will ... "I have been asked to perform a security audit of 1 IP address for client." ... If I enter the IP address and then /webblaze, I am taken to a login page ...
    (Pen-Test)
  • Re: NIS (client) issues...
    ... and any one of them might use the client machine from time ... Perhaps the documentations reagarding NIS simply take ... We have centralized NFS mounted home directories. ... but can not login because /etc/password does not list ...
    (alt.os.linux.suse)