RE: HTTP AUTH BASIC monowall.

["Lyal Collins" <lyal.collins () key2it com au>]

Although something else may have been intended by using the phrase
"password-authenticated key agreement", lets not forget that's all PKI is -
key agreement based on verifying a password.
At the server end, the site admins password is verified e.g. for SSL servers
At the client, if you're lucky, the user chose a hard to crack password.

That, and the access controls on each ndpoint is all that authenticates any
PKI-based schema.

Lyal

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Jeremy
Bishop
Sent: Tuesday, 14 March 2006 8:02 AM
To: full-disclosure () lists grok org uk
Subject: Re: [Full-disclosure] HTTP AUTH BASIC monowall.


On Monday 13 March 2006 12:37, you wrote:
> List,
>     SSL is not a fix for the problem, SSL is just a way of evading the 
> issue or hiding the hole. I can bypass SSL with a man in the middle 
> attack (which I've already done several times). Once I bypass

I'm assuming that this is using unsigned or otherwise invalid 
certificates, and relying on user ignorance or apathy to succeed.

>     What is the solution to this problem? Is there a solution that 
> does not require a different auth type?

SSL.  (Done correctly.)

Any "solution" is likely to rely on public-key crypto and as such will 
require a similar mechanism for verifying identity.  If sufficiently 
widespread, apathy and ignorance will render it vulnerable to the exact 
same problems.

I suggest "password-authenticated key agreement" as a starting point for 
research outside the traditional public-key methods.  (Although, as far 
as I can tell, it would require the "password" to be accessible to the 
server so that the session can be set up.  IOW, you get around the 
problems of trusting a cert, but you're back to storing passwords in 
plaintext.)

Jeremy

-- 
Rules build up fortifications behind which small minds create satrapies. A
perilous state of affairs in the best of times, disastrous during crises.
                         -- Bene Gesserit Coda

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/