Network Working Group D. Taylor
Internet-Draft Forge Research Pty Ltd
Expires: August 6, 2001 February 5, 2001
Using SRP for TLS Authentication
draft-taylor-tls-srp-00.txt
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on August 6, 2001.
Copyright Notice
Copyright (C) The Internet Society (2001). All Rights Reserved.
Abstract
This memo presents a technique for using the SRP (Secure Remote
Password) protocol as an authentication method for the TLS
(Transport Layer Security) protocol.
Taylor Expires August 6, 2001 [Page 1]
Internet-Draft Using SRP for TLS Authentication February 2001
1. Introduction
At the time of writing, TLS[1] uses public key certificiates with
RSA/DSA digital signatures, or Kerberos, for authentication.
These authentication methods do not seem well suited to the
applications now being adapted to use TLS (IMAP[3], FTP[4], or
TELNET[5], for example). Given these protocols (and others like
them) are designed to use the user name and password method of
authentication, being able to use user names and passwords to
authenticate the TLS connection seems to be a useful feature.
SRP[2] is an authentication method that allows the use of user names
and passwords in a safe manner.
This document describes the use of the SRP authentication method for
TLS.
Taylor Expires August 6, 2001 [Page 2]
Internet-Draft Using SRP for TLS Authentication February 2001
2. SRP Authentication in TLS
2.1 Modifications to the TLS Handshake Sequence
The SRP protocol can not be implemented using the sequence of
handshake messages defined in [1] due to the sequence in which the
SRP messages must be sent.
This document proposes a new sequence of handshake messages for
handshakes using the SRP authentication method.
2.1.1 Message Sequence
Handshake Message Flow for SRP Authentication
Client Server
| |
Client Hello (U) ------------------------> |
| <---------------------------- Server Hello
| <---------------------------- Server Key Exchange (g, N, s)
Client Key Exchange (A) -----------------> |
| <---------------------------- Server Key Exchange (B)
| <---------------------------- Server Hello Done
change cipher spec |
Finished --------------------------------> |
| change cipher spec
| <---------------------------- Finished
| |
The identifiers given after each message name refer to variables
defined in [2] that are sent in that message.
This new handshake sequence has a number of differences from the
standard TLS handshake sequence:
o The client hello message has the user name appended to the
message. This is allowable as stated in section 7.4.1.2 of [1].
o The client cannot generate its its public key (A) until after it
has received the (g) and (N) paramters from the server, and the
client must send its public key before it receives the servers
public key (B) (as stated in section 3 of [2]). This means the
client must wait for a server key exchange message containing (g)
and (N), send a client key exchange message containing (A), and
then wait for another server key exchange message containing (B).
o There is no server identification in this version of a TLS
handshake. If an attacker gets the SRP password file, they can
masquerade as the real system.
Taylor Expires August 6, 2001 [Page 3]
Internet-Draft Using SRP for TLS Authentication February 2001
2.2 Changes to the Handshake Message Contents
This section describes the changes to the TLS handshake message
contents when SRP is being used for authentication. The details of
the on-the-wire changes are given in Section 2.5.
2.2.1 The Client Hello Message
The user name is appended to the standard client hello message. The
extra data is included in the handshake message hashes.
2.2.2 The First Server Key Exchange Message
The server key exchange message in the first round contains the
generator (g), the prime (N), and the salt value (s) read from the
SRP password file.
2.2.3 The Client Key Exchange Message
The client key exchange message carries the clients public key (A),
which is calculated using both information known locally, and
information received in the first server key exchange message. This
message MUST be sent between the first and second server key
exchange messages.
2.2.4 The Second Server Key Exchange Message
The server key exchange message in the second round contains the
servers public key (B).
2.3 Calculating the Pre-master Secret
The shared secret resulting from the SRP calculations (S) is used as
the pre-master secret.
The finished messages perform the same function as the client and
server evidence messages specified in [2]. If either the client or
the server calculate an incorrect value, the finished messages will
not be understood, and the connection will be dropped as specified
in [1].
2.4 Cipher Suite Definitions
The following cipher suites are added by this draft. The numbers
have been left blank until a suitable range has been selected.
CipherSuite TLS_SRP_WITH_3DES_EDE_CBC_SHA = { ?,? };
CipherSuite TLS_SRP_WITH_RC4_128_SHA = { ?,? };
Taylor Expires August 6, 2001 [Page 4]
Internet-Draft Using SRP for TLS Authentication February 2001
CipherSuite TLS_SRP_WITH_IDEA_CBC_SHA = { ?,? };
CipherSuite TLS_SRP_WITH_3DES_EDE_CBC_MD5 = { ?,? };
CipherSuite TLS_SRP_WITH_RC4_128_MD5 = { ?,? };
CipherSuite TLS_SRP_WITH_IDEA_CBC_MD5 = { ?,? };
2.5 New Message Structures
This section shows the structure of the messages passed during a
handshake that uses SRP for authentication. The representation
language used is that used in [1].
opaque Username<1..2^8-1>;
enum { non_srp, srp } CipherSuiteType;
struct {
ProtocolVersion client_version;
Random random;
SessionID session_id;
CipherSuite cipher_suites<2..2^16-1>;
/* Need a better way to show the optional user_name field */
select (CipherSuiteType) {
case non_srp:
CompressionMethod compression_methods<1..2^8-1>;
case srp:
CompressionMethod compression_methods<1..2^8-1>;
Username user_name; /* new entry */
};
} ClientHello;
enum { rsa, diffie_hellman, srp } KeyExchangeAlgorithm;
enum { first, second } KeyExchangeRound;
struct {
select (KeyExchangeRound) {
case first:
opaque srp_s<1..2^8-1>
opaque srp_N<1..2^16-1>;
opaque srp_g<1..2^16-1>;
case second:
opaque srp_B<1..2^16-1>;
};
} ServerSRPParams; /* SRP parameters */
Taylor Expires August 6, 2001 [Page 5]
Internet-Draft Using SRP for TLS Authentication February 2001
struct {
select (KeyExchangeAlgorithm) {
case diffie_hellman:
ServerDHParams params;
Signature signed_params;
case rsa:
ServerRSAParams params;
Signature signed_params;
case srp:
ServerSRPParams params; /* new entry */
};
} ServerKeyExchange;
struct {
opaque srp_A<1..2^16-1>;
} SRPClientEphemeralPublic;
struct {
select (KeyExchangeAlgorithm) {
case rsa: EncryptedPreMasterSecret;
case diffie_hellman: ClientDiffieHellmanPublic;
case srp: SRPClientEphemeralPublic; /* new entry */
} exchange_keys;
} ClientKeyExchange;
Taylor Expires August 6, 2001 [Page 6]
Internet-Draft Using SRP for TLS Authentication February 2001
3. Security Considerations
There is no server identification in this version of a TLS
handshake. If an attacker gets the SRP password file, they can
masquerade as the real system.
What are the security issues of this new handshake sequence? Are the
SRP parameters passed in a safe order? Is it a problem having the
username appended to the client hello message?
Taylor Expires August 6, 2001 [Page 7]
Internet-Draft Using SRP for TLS Authentication February 2001
References
[1] Dierks, T. and C. Allen, "The TLS Protocol", RFC 2246, January
1999.
[2] Wu, T., "The SRP Authentication and Key Exchange System", RFC
2945, September 2000.
[3] Newman, C., "Using TLS with IMAP, POP3 and ACAP", RFC 2595,
June 1999.
[4] Ford-Hutchinson, P., Carpenter, M., Hudson, T., Murray, E. and
V. Wiegand, "Securing FTP with TLS",
draft-murray-auth-ftp-ssl-06 (work in progress), September 2000.
[5] Boe, M. and J. Altman, "TLS-based Telnet Security",
draft-ietf-tn3270e-telnet-tls-05 (work in progress), October
2000.
Author's Address
David Taylor
Forge Research Pty Ltd
EMail: DavidTaylor@forge.com.au
URI: http://www.protekt.com/
Taylor Expires August 6, 2001 [Page 8]
Internet-Draft Using SRP for TLS Authentication February 2001
Full Copyright Statement
Copyright (C) The Internet Society (2001). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph
are included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC editor function is currently provided by the
Internet Society.
Taylor Expires August 6, 2001 [Page 9]