Subject: [Isms] Comments on draft-ietf-isms-secshell-07.txt

From: "David B. Nelson" <[email-masked]>
Date: Wed, 27 Jun 2007 17:58:44 -0400

In section 3.1.3:   

   It is also possible to use a different
   password validation protocol such as CHAP [RFC1994] or digest
   authentication [RFC 2617, draft-ietf-radext-digest-auth-04] to
   integrate with RADIUS or Diameter.  These mechanisms leave the
   password in the clear on the device that is authenticating the
   password which introduces threats to the authentication
   infrastructure.

Note that draft-ietf-radext-digest-auth-04 has been published as RFC 4590.
This is currently under revision, to fix a couple or errors, as
draft-ietf-radext-rfc4590bis-01.txt.

In the second sentence I would recommend changing "leave" to "require".

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David Harrington" <[email-masked]>
Date: Wed, 27 Jun 2007 18:17:12 -0400

Hi,

I am of the impression that implementers can encrypt their own storage
of the password, so I don't see "require" or "leave" as accurate. How
about,

"At some point during the processing, these mechanisms require the
password be made available as cleartext on the device ... which might
introduce ...".

dbh

> -----Original Message-----
> From: David B. Nelson [mailto:[email-masked]] 
> Sent: Wednesday, June 27, 2007 5:59 PM
> To: [email-masked]
> Subject: [Isms] Comments on draft-ietf-isms-secshell-07.txt
> 
> In section 3.1.3:   
>

---

From: "David Harrington" <[email-masked]>
Date: Wed, 27 Jun 2007 18:22:15 -0400

Hi,

I updated the reference to RFC4590, which I think is sufficient at
this point. 

dbh

---

From: "David B. Nelson" <[email-masked]>
Date: Thu, 28 Jun 2007 08:19:37 -0400

David Harrington writes...

> of the password ...

Yes, reversible encryption of the password would be possible, while a hash
would not.

> How about,

Sure.

---

From: "David Harrington" <[email-masked]>
Date: Thu, 28 Jun 2007 12:33:07 -0400

done. 

> Sent: Thursday, June 28, 2007 8:20 AM
> To: [email-masked]
> Subject: RE: [Isms] Comments on draft-ietf-isms-secshell-07.txt
>