RE: Gauntlet & NTLM

["Ge' Weijers" <ge () progressive-systems com>]

On Mon, 13 Oct 1997, Craig Brozefsky wrote:

> 3.  The encryption is laughable 40 bit RSA WITHOUT EVER RENEGOTIATING
> KEYS!!!!!  This means I now have tons of data encrypted with the same lame
> 40 but key, and because of all the encapsulation a good percentage of that
> is known plaintext from the packet headers (IP/GRE/PPP/IP/TCP).  40 bit is
> bad enough but without key negotiation over the lifetime of the connection
> it's severly degraded.

The key is changed every 256 packets, whenever the low byte of MPPE
frame's serial number hits 0. All the keys are derived from the original
(MS-)CHAP exchange, though, so you do not get perfect forward
secrecy. The amount of data sent with one key is limited to 256 * MTU, a
couple hundred Kbytes at the most.

The TCP control connection can certainly be attacked, but I don't see
how that will help the attacker in gaining access to the server
side. Denial of service attacks should be relatively easy, though.

Ge'