1. Web Server Design Week 12 Old Dominion University Department of Computer Science CS 495/595 Spring 2010 Martin Klein 3/31/10

2. Problems with Basic Authentication Password sent in clear Cannot authenticate the server to the client –e.g. “phishing” attacks –uid/passwd may be used at other sites too

3. Digest Authentication Does: –securely transmit the password –bi-directional authentication But does not protect the session!!! –“https” uses 1 of: Transport Layer Security –http://www.ietf.org/html.charters/tls-charter.htmlhttp://www.ietf.org/html.charters/tls-charter.html Secure Socket Layer –http://web.archive.org/web/20080410061639/http://wp.netscape. com/eng/ssl3/

4. Replay Attacks Eavesdrop on the unencrypted c/s conversation With basic, the bad guy has access to all URIs protected with that u/p With digest: –replay is limited to the resource the bad guy already overheard –the vulnerability “window” is determined by the nonce value PUT/POST methods need stronger nonce values (e.g., one- time use) and/or qop=auth-int

5. Multiple Authentication Schemes According to section 14.47 of RFC 2616 (and section 4.6 of RFC 2617), a single “WWW- Authenticate” header can provide more than 1 challenge –it is up to the client to choose the strongest challenge it understands –(n.b., I’m not sure how to do this with Apache; we will not issue multiple challenges in our project) RFC 2616, sec. 14.47: … User agents are advised to take special care in parsing the WWW- Authenticate field value as it might contain more than one challenge, or if more than one WWW-Authenticate header field is provided, the contents of a challenge itself can contain a comma-separated list of authentication parameters.

6. Dictionary Attacks Digest authentication offers no real protection against poorly chosen passwords –grabbing the nonce/response pair(s), eavesdropper can quickly run through a dictionary of common passwords trying to recreate the response Dictionary = {root,$user,$user$user,reverse($user),Spock, Whorf,Gandalf,eagle,mustang,password, mypassword,123,asdf,fluffy,fido,…} Make dictionary attacks harder with salt. # user format = name:realm:md5(name:realm:password) mklein:Colonial Place:53bbb5135e0f39c1eb54804a66a95f08 # user format = name:realm:md5(name:realm:password:salt):salt mklein:Colonial Place:e65c90343b763abb9e442dd03ae79aac:12

7. Man in the Middle A corrupted proxy (or a “phishing” server) could request your credentials: –basic: now it has your passwd (good for all URIs) –digest: it has authentication for a single URI The very existence of “basic” is a problem –passwords are often shared among domains, realms, auth methods –client s/w & users have to be smart

8. Chosen Plaintext Attack MITM attacks (or phishing server) have control of generating the nonce values –knowing the original input makes cryptoanalysis a little bit easier: http://web.archive.org/web/19970607055704/http://www.rsa.com/rsalabs/pubs/cryptobytes/spring95/md5.htm “Cribs” –http://www.cs.miami.edu/~harald/enigma/http://www.cs.miami.edu/~harald/enigma/ –http://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigmahttp://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma – client can counter w/ cnonce, since MITM will not know what the original input was for the cnonce value

9. Batch Bruce Force Attacks Variation on the plaintext attack: MITM/phisher collects multiple responses from multiple users for the same nonce Time to find first passwd decreases by the factor of the known nonce/response pairs

10. Precomputed Dictionary Attack Combination of dictionary + plaintext Compute a dictionary of (response,passwd) pairs for the known nonce value(s) Computation can be done in parallel on zombie machines

11. Password Files Even though the server (Apache) stores passwords in the form of: –user:realm:md5(user:realm:passwd) if the passwd file is compromised (e.g., filesystem access), then the URIs in that realm are compromised –password does not need to be guessed –treat this passwd file as if the passwds are in the clear (unlike standard unix passwd file)