|
|
Initiation responsibility: IT Security Management, Administrators
Implementation responsibility: Administrators
Many ISDN cards support communications via a Point-to-Point Protocol (RFC 1661) after an ISDN switched connection has been established. This Internet standard also offers authentication protocols such as the Password Authentication Protocol (PAP) and the Challenge Handshake Authentication Protocol (CHAP) (RFC 1994). If the ISDN card in use provides these functions, authentication should be performed with the Challenge-Handshake Authentication Protocol instead of the Password Authentication Protocol, because in the case of the latter, the password used for authentication is transmitted in plain-text form.
As a rule, the passwords used by PAP and CHAP are stored in the IT systems, so that they do not have to be entered by the user each time authentication is required. To allow continued use of these processes following a re-installation, the required passwords should be noted down and kept in a safe place (refer to S 2.22 Depositing of passwords).
Mode of operation:
CHAP always distinguishes between two types of communication partner: authenticator and peer. The authenticator is the communication partner requesting authentication, while the peer is the communication partner needing to submit authentication. In general therefore, the authenticator comprises the server which users need to log into as peers from their respective IT systems.
CHAP checks for the recognition of a common secret (password) on both communicating sides. This password is not transferred as plain text through the communications lines, and is protected against replay by integrating random numbers.
A Challenge-Response-Protocol is sequenced as follows:
To start with, the authenticator computes a random number. The hash value of the computed, random number is then formed using a hash algorithm. A hash function is a computing instruction which converts inputs of any length into outputs of a fixed (usually shorter) length. A one-way hash function only works in one direction, i.e. it easily allows hash values to be calculated from inputs, but makes it very difficult, if not impossible, to calculate inputs corresponding to hash values.
In the next step, the authenticator transfers the challenge, i.e. the random number just calculated, to the peer. As the authenticator and peer both possess the same hash algorithm, the peer is able to form the hash value of the transferred random number in a fourth step. The peer calculates the hash value using three parameters: the identifier (user ID), secret (password) and the transferred random number. It then transmits the hash value as a response to the authenticator. The authenticator checks the correctness of the password by also calculating the corresponding hash value and comparing it with the received one. If the comparison is positive, the peer has been successfully authenticated by the authenticator and the communications link can be established.
Authentication using this technique should also be repeated several times while a communications link is in use, in order to prevent intrusions into active links. This can be triggered by the authenticator at sporadic intervals, without the need for user intervention.
Additional controls:
| © Copyright
by Bundesamt für Sicherheit in der Informationstechnik |
July 1999 |