Subject: [Simple] RFC3261 Basic Authentication

From: "Griff James" <[email-masked]>
Date: Wed, 21 Aug 2002 15:46:35 +0100

I am new to the mailing list, so please excuse me if I have missed something obvious.

RFC3261 has made changes to remove basic authentication.

Perhaps it should not allow basic authentication for non-TLS connections.

Many messaging systems such as the Gordano Messaging Server, Exchange etc allow users to be authenticated via external databases e.g. NTSAM.
This means that a plain text password is not available to perform digest authentication at the server side.

Performing user level authentication would not be possible where a plain text password is not available.

Griff

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 26 Aug 2002 12:48:48 -0500

That's right. Plain text passwords being transmitted around the net are
generally dangerous and scary things and should be approached with
extreme caution. Actually, many people feel that plain text passwords
are inherently dangerous, even if never accessed outside of a given
system. This has led to the development of one-way hash function
passwords such as used in most UNIX systems. Someone once said that "the
insecurity of a password decreases with the exponent of the number of
places it is stored", which is probably a variation on "a secret is
something known to only one person". Though questionably provable, these
expressions convey the sentiment nicely.

The same basic issue occurred in the dial-up Internet world when
Challenge-Handshake Authentication Protocol (CHAP) replaced Password
Authentication Protocol (PAP) in common use. Since the client wasn't
sending the plaintext password anymore, either the back-end server had
to cough up the password OR implement the same handshake calculation
algorithm and execute it on behalf of the terminal server.

We should be able to learn something from all the RADIUS and DIAMETER
work done to support this model.

What appears to be needed here is for the back-end-database to be able
to perform the digest authentication step on behalf of the server. The
call becomes something like "Here, please digest this message as griffj
would digest it and get back to me" or "Here, please check this message
that griffj claims to have digested and tell me if it's from him".

--
Dean

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Griff James
> Sent: Wednesday, August 21, 2002 9:47 AM
> To: [email-masked]
> Subject: [Simple] RFC3261 Basic Authentication
> 
> 
> Many messaging systems such as the Gordano Messaging Server, 
> Exchange etc allow users to be authenticated via external 
> databases e.g. NTSAM. This means that a plain text password 
> is not available to perform digest authentication at the server side.
> 
> Performing user level authentication would not be possible 
> where a plain text password is not available.
> 
> Griff
> 
> 
> 
>