Subject: PPP and password maintenance

From: [email-masked]
Date: Mon, 30 Oct 2000 15:40:17 -0500

Good folk of the PPP mailing list,

I was recently forwarded a customer comment about how our PPP
implementation handles passwords. The customer was annoyed because we
"require" him to maintain two password databases. One password database is
for the system signon userids. System signon passwords are always stored
using a non-reversible hash/encryption. However, the ids used for PPP
authentication are stored using a reversible encryption.

We do it this way for historical reasons, of course. The security for the
signon userids was implemented before PPP was. (Heck, it was probably
implemented before the Internet was implemented ;-).  I cannot see a way to
implement CHAP (for example) without being able to extract the original
password so that it can be hashed with the CHAP challenge. (Am I
overlooking something ???)

What I'm curious about is how passwords are handled in other PPP
implementations. I hope I can get some feedback from the mailing list about
this.

I have a nearly 20 year old memory that UNIX also uses a one way encryption
scheme to store its system signon passwords. If that is still true then I
would expect a UNIX PPP implementations to have the same "multiple
maintenance" password concerns. Is this true? If so, is using RADIUS the
most common way used to consolidate userid/password maintenance?

I'm also curious what Windows does.  My guess is that non-NT versions of
windows always store passwords with a reversible encryption. Perhaps this
is also how NT/Win2K windows systems do it, at least by default. I have
seen a Win2K Professional local security policy with the title "Store
password using reversible encryption for all users in the domain". On my
Win2K system this policy is enabled. I'm not sure if there are any
consequences to Windows Dial Up Networking if this security policy is
disabled.

-john martz, 8-852-5539,  [email-masked]
IBM AS/400 TCP/IP PPP development (and stuff)

---

From: James Carlson <[email-masked]>
Date: Mon, 30 Oct 2000 15:55:44 -0500 (EST)

> authentication are stored using a reversible encryption.

Using reversible encryption for something like this is, in my opinion,
worthless; it's essentially no security at all.

> overlooking something ???)

That's correct.  You need access to a cleartext passphrase in order to
authenticate a peer using CHAP.  PAP, however, does not require this.
You can authenticate a peer with PAP through the regular AIX
/etc/security/shadow (or NIS) interfaces (or whatever it is that an
AS/400 does for user validation).

> implementations. I hope I can get some feedback from the mailing list about

All that I've seen have two databases for this.  It's a rather
standard problem.

> most common way used to consolidate userid/password maintenance?

It's true if you're using CHAP.  Note that if you do RADIUS, you can
authenticate the peer, but you cannot authenticate yourself *to* the
peer using the same mechanism.  Also note that RADIUS doesn't actually
fix the problem -- it just moves it to another location.

> is also how NT/Win2K windows systems do it, at least by default.

NT, at least, has two databases -- one is an MD4 hash of a user's
password.  This is used for validating PAP users and is also used
(essentially) as a cleartext key for the MS-CHAP variants.  For CHAP
on NT, there's a completely separate registry of cleartext
passphrases.

Non-NT Windows systems are supposed to be "clients" only, and I think
they simply query the user for the necessary information (and
optionally store a single peer name / passphrase combination to make
theft easier).

> I have

It's often hard to map from menu text to actual implementation ...

-- 
James Carlson                                  <[email-masked]>
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp