Re: PPTP Revisited

[aleph1 () UNDERGROUND ORG (aleph1 () UNDERGROUND ORG)]

On Sat, Feb 13, 1999 at 03:39:05PM -0800, Paul Leach wrote:
> Nice analysis. Correct as far as I can see with a quick review. I only have
> one quibble with it. See below...
>
> > -----Original Message-----
> > From: aleph1 () UNDERGROUND ORG [mailto:aleph1 () UNDERGROUND ORG]
> > Sent: Saturday, February 13, 1999 11:29 AM
> > To: BUGTRAQ () NETSPACE ORG
> > Subject: PPTP Revisited
> >
> >
> > · MPPE does not provide true 128-bit or 40-bit security.
> >
> > This is still true. Under MSCHAPv2 the MPPE session keys
> > continue to be
> > derived from the user password, the challenges, and some
> > magic numbers. All
> > this information is public with the exception of the
> > password, ergo the
> > session key is only as strong at the password.
>
> Some comments:
> The conclusion that the session key is only as strong as the password is
> true. I think it is somewhat misleading to conclude that the protocol
> doesn't offer "true" 40 or 128 bit security. It is easy to have a password
> that is more than 40 bits in strength.
>
> To give some context, it is equally true that Kerberos 5 does not provide
> "true" 40 or 128 bit security -- even though it generates random session
> keys, the ticket granting ticket containing the initial session key is
> encrypted with a key derived from the password.

That is correct. That is why you can perform a dictionary attack againts
Kerberos. Given this I don't see why you consider it missleading. I would
consider missleading claiming that Kerberos offers 40 or 128 bit security.

> To my knowledge, the same will hold for any authentication and key exchange
> protocol that doesn't use public key technology.

Well technically it is true for any protocol where the keys are not derived
from true random sources, the problem is having both parties agree to the
key. This can normally can be acomplished via public key technology. But
as you point out above even password based schemes like PPTP's can provide
40 or 128-bit security, if they pasword itself provides 40 or 128-bit security
its simply that for the average password this is not true.

> Paul

--
Aleph One / aleph1 () underground org
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01