blu @
jericho .
mc .
com (Brian Utterback) writes:
|Brent, you've hit the nail on the head. Skey is more vulnerable because it
|*can* be subject to dictionary attacks. The user has to remember not to use
|anything memorable. The first time I used Skey, I used "carrots" as my
|passphrase. Never again. Security that is based on the user doing the right
|thing is inherently less secure than security that is automatic. And don't try
|to fool me, you already know this.
This isn't a problem inherent with S/key, actually. Its with the way
the designers of S/key imply it is to be administered, which I didn't buy
into when I installed it.
In our installation, *I* set up their password seed keys for the users, and
don't allow them to do it themselves nor do I even let them know the key,
thus negating the worry about the users doing the "right thing". The general
lack of documentation of the package was part of the decision (I didn't feel
like rewriting the docs, nor did I feel like explaining it verbally to each
user). A lot cheaper than calculators, and its up to *me* how vulnerable I
make each passphrase to a dictionary attack. (Actually, a gentle fist on the
keyboard a couple of times makes a pretty good passkey, and I bet its not
very easy to crack, either :-). I only have to do it for about ten percent
of our 200 users (only this many have expressed any need to log in from the
outside via the Internet link), which means I generate a password list very
rarely.
However, those with larger user bases with a valid need to telnet in via the
Internet might find this too administration-intensive. Neither would those
with large outside users be as likely to cough up the cash for the calculators,
and there is no need to, since a modification to the Skey code would negate
most of it. It would not be very hard to write a new program based on the
current Skey, and have it accept a user ID, then 1) generate a random or
pseudo-random key seed, 2) initialize the skeykeys file for the supplied UID,
and 3) output a list of passwords for the user, and do all three of these
steps by executing just the one program.
So, while I agree somewhat with the criticisms of skey as it seems to be
designed to be installed, but the answer to that could be to simply administer
it intelligently or modify it slighty, and thus just not open up that hole.
Randy Davis Email: randy @
megatek .
com
Corporate Network and System Administrator
Megatek Corporation, San Diego, California
Follow-Ups:
|
|
