Re: Authentication or integrity?

[David Jablon <dpj@xxxxxxxxxxxxx>]

Dale,

Your suggestion does not address Eric's question of how a credential
in transit can be protected with *more entropy* than what's in the password.

However, if Dale protects the credential in an encrypted transmission keyed
by a negotiated password-authenticated key (instead of using standard
password-based symmetric encryption), he can get there from here.

Even though the credential stored at the server may be password-crackable,
the transmitted form can be protected with a guaranteed-strong key.

-- David


Eric Norman wrote:
>> Since all the user has available and knows and can remember is a
>> (possibly low entropy) password, how can a message that the user
>> constructs be protected by any more entropy than that?

At 04:57 PM 4/4/01 -0500, Dale Gustafson replied:
>The credential is protected by a credential password (password-based-encryption).
>
>The client-server session is protected by an access password (a 2nd layer of pbe)
>during transfer from server to client or vice versa.
>
>It is reasonable to assume that credential servers will apply an additional layer
>of strong encryption before transfer to long-term storage, split the credential
>among several credential stores, etc.
>
>Client software could ensure the use of access passwords with adequate entropy
>levels.
>
>> Eric Norman

---------------------------------------------------
David P. Jablon
dpj@xxxxxxxxxxxxx
www.IntegritySciences.com
www.Phoenix.com