Subject: RE: [Ips] What is the max size of value for CHAP_C for iSCSI

From: [email-masked]
Date: Fri, 2 Sep 2005 12:47:14 -0400

I want to reinforce one of Paul's points:

> Section 11.1.4 says 1024 bytes.  If it's a strong random number (as it
> should be) that's much more than is useful -- 16 bytes would be the
> minimum adequate length, a bit more (up to 32 or so) would ok too.

The security of iSCSI CHAP is based on use of strong random numbers
for challenges, and especially for CHAP secrets.  If easy-to-remember
things (e.g., passwords) are used for secrets, the resulting security
is weak and easy to break.

To a first approximation, anything that is easy for a human to remember
is weak and vulnerable to a brute force guessing attack, and for CHAP,
that attack is off-line (can be done in private as it's not necessary
to check each possibility against the system to be attacked).

The bottom line is: **Don't use weak secrets such as passwords with
iSCSI CHAP, and don't encourage or enable their use**.

Also, most pseudo random number generators do not generate strong random
numbers.  Don't use pseudo random number generators to generate iSCSI
CHAP challenges or secrets unless you know *exactly* what you're doing
(requires cryptographic expertise) and have a cryptographically strong
pseudo random number generator (e.g., uses SHA-1 as part of the
generation algorithm).

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: Paul Koning <[email-masked]>
Date: Fri, 2 Sep 2005 13:32:31 -0400

>>>>> "Black" == Black David <[email-masked]> writes:

 Black> Also, most pseudo random number generators do not generate
 Black> strong random numbers.  Don't use pseudo random number
 Black> generators to generate iSCSI CHAP challenges or secrets unless
 Black> you know *exactly* what you're doing (requires cryptographic
 Black> expertise) and have a cryptographically strong pseudo random
 Black> number generator (e.g., uses SHA-1 as part of the generation
 Black> algorithm).

That's excellent advice.

I'd add a few points to this:

1. Read RFC 1750.  Until you understand what it is telling, you don't
   know enough to proceed.

2. See if your OS has a "cryptographically strong random number
   generator" -- such as /dev/random in Linux and NetBSD.  If yes, 
   AND it is hooked up to sources of entropy, your best answer almost
   certainly is to use it (but see point 1).

The reason for the point about entropy: if you're building an embedded
system, the conventional sources of entropy that the /dev/random code
uses may not be active at all, and you'll have to search for others.
(If you do, again see point 1.)

    paul