Subject: RE: Help Please - SHA1 Authentication Algorithm Packaged Con

From: "Smith, Chris" <[email-masked]>
Date: Tue, 25 May 1999 12:28:00 -0400

Roughly:

<AuthReqBlk>
  <AuthReq ID="M1.w" AuthenticationID="AUTH1111">
    <Algorithm ID="M1.x" type="digest" name="iotp:sha1>
    <PackagedContent Name="DOMAIN" Content="PCDATA" Transform="BASE64">
      AAAABBBBZZZZ
    </PackagedContent>
    <PackagedContent Name="CHALLENGE" Content="PCDATA" Transform="BASE64">
      AAAABBBBZZZZ
    </PackagedContent>
  </AuthReq>
</AuthReqBlk>

<AuthRespBlk>
  <AuthResp AuthenticationId="AUTH1111" >
    <PackagedContent Name="SALT" Content="PCDATA" Transform="BASE64">
      AAAABBBBZZZZ
    </PackagedContent>
    <PackagedContent Name="DIGEST" Content="PCDATA" Transform="BASE64">
      AAAABBBBZZZZ
    </PackagedContent>
  </AuthResp>
</AuthRespBlk>

Although the transform of BASE64 is not required, under the cicumstances, I 
would think it would be wise.

The process is (off the top of my head, comment if required):

1) Identify the Algorithm; if it is SHA1 digest authentication, proceed.
   (Note that HMAC:SHA1 is likely preferred).

   I have used a sample name above - we should likely nail down this name.

2) Extract the DOMAIN, and determine (by query of file, database or user)
   if authentication can proceed against this DOMAIN. (Query against user,
   can be roughly interpreted as "ask for password"). Only proceed if
   the DOMAIN is accepted.

   In many cases, the DOMAIN may be a plain text string presented to the
user;
   in this regard, this is similar to Basic web authentication.

3) Choose an unpredictable (random is good, non-repeated is good) SALT.

4) Get the local SECRET.

5) Assemble the plaintext:

   DOMAIN NULL CHALLENGE NULL SECRET NULL SALT

   where NULL is a single byte of value Zero. The NULL separator raises the
   difficulty of structuring attacks based on moving information between the
   various elements of the plaintext without changing the DIGEST.

6) Generate the digest over the plaintext (using SHA1 or, better, HMAC
SHA1).

7) OFFICIALLY FORGET THE LOCAL SECRET. 

   Always a wise precaution.

8) Return the SALT and the DIGEST as described above.

   Again, BASE64 is not required, but is wise.

X) Unspecified here is the effect of interaction between various
wide-character
   formats, byte-ordering, and the digest algorithm.

...chris

______________________________ Reply Separator
_________________________________
Subject: Help Please - SHA1 Authentication Algorithm Packaged Content
Author:  "David Burdett" [SMTP:[email-masked]] at Internet
Date:    1999/05/21 09:50 PM

The Authentication Request Component (see other email) now says:

"If required the Algorithm may use the challenge data, contained in the 
Packaged Content elements within the Authentication Request Component in its

calculation. The format of the Packaged Contents are Algorithm dependent."

Can anyone help with defining the Packaged Content for the Challenge if the 
Authentication Algorithm is SHA1 - other values for the Algorithm (signature

and Payment Protocol dependent) I think are covered elsewhere.

David
> mailto:<[email-masked]>
> Mondex International, US Advanced Technology Office 
> 111 Pine St, 6th Floor, San Francisco, CA 94111
> Tel/Voicemail: +1 415 645 6973     Fax: +1 415 956 9370 
>

****************************************************************************
****
**************

This Email and any attached files are confidential and may also be
privileged. 
If you are not the intended recipient, please notify the postmaster using
email 
address [email-masked] or call +44 171 557 5000 and ask for the
IT Helpdesk.  You should not copy this email and any attached files, use
them 
for any purpose or disclose the contents to any other person; all copies of
the 
Email and associated files in your possession should be destroyed.

Mondex International Limited
47-53 Cannon Street
London EC4M 5SQ
United Kingdom
Registered No: 3122085, England

Phone:          +44 171 557 5000
Fax:            +44 171 557 5200
Email:          [email-masked]
WebSite:        http://www.mondexinternational.com

****************************************************************************
****
*************
----------------------------------------------------------------------- 
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the 
body to: [email-masked]