1*a619718eSchristosEAP with MD5-Challenge and SRP-SHA1 support 2*a619718eSchristosby James Carlson, Sun Microsystems 3*a619718eSchristosVersion 2, September 22nd, 2002 4*a619718eSchristos 5*a619718eSchristos 6*a619718eSchristos1. What it does 7*a619718eSchristos 8*a619718eSchristos The Extensible Authentication Protocol (EAP; RFC 2284) is a 9*a619718eSchristos security protocol that can be used with PPP. It provides a means 10*a619718eSchristos to plug in multiple optional authentication methods. 11*a619718eSchristos 12*a619718eSchristos This implementation includes the required default MD5-Challenge 13*a619718eSchristos method, which is similar to CHAP (RFC 1994), as well as the new 14*a619718eSchristos SRP-SHA1 method. This latter method relies on an exchange that is 15*a619718eSchristos not vulnerable to dictionary attacks (as is CHAP), does not 16*a619718eSchristos require the server to keep a cleartext copy of the secret (as in 17*a619718eSchristos CHAP), supports identity privacy, and produces a temporary shared 18*a619718eSchristos key that could be used for data encryption. 19*a619718eSchristos 20*a619718eSchristos The SRP-SHA1 method is based on draft-ietf-pppext-eap-srp-03.txt, 21*a619718eSchristos a work in progress. 22*a619718eSchristos 23*a619718eSchristos2. Required libraries 24*a619718eSchristos 25*a619718eSchristos Two other packages are required first. Download and install 26*a619718eSchristos OpenSSL and Thomas Wu's SRP implementation. 27*a619718eSchristos 28*a619718eSchristos http://www.openssl.org/ (or ftp://ftp.openssl.org/source/) 29*a619718eSchristos http://srp.stanford.edu/ 30*a619718eSchristos 31*a619718eSchristos Follow the directions in each package to install the SSL and SRP 32*a619718eSchristos libraries. Once SRP is installed, you may run tconf as root to 33*a619718eSchristos create known fields, if desired. (This step is not required.) 34*a619718eSchristos 35*a619718eSchristos3. Installing the patch 36*a619718eSchristos 37*a619718eSchristos The EAP-SRP patch described here is integrated into this version 38*a619718eSchristos of pppd. The following patch may be used with older pppd sources: 39*a619718eSchristos 40*a619718eSchristos ftp://playground.sun.com/carlsonj/eap/ppp-2.4.1-eap-1.tar.gz 41*a619718eSchristos 42*a619718eSchristos Configure, compile, and install as root. You may want to edit 43*a619718eSchristos pppd/Makefile after configuring to enable or disable optional 44*a619718eSchristos features. 45*a619718eSchristos 46*a619718eSchristos % ./configure 47*a619718eSchristos % make 48*a619718eSchristos % su 49*a619718eSchristos # make install 50*a619718eSchristos 51*a619718eSchristos If you use csh or tcsh, run "rehash" to pick up the new commands. 52*a619718eSchristos 53*a619718eSchristos If you're using Solaris, and you run into trouble with the 54*a619718eSchristos pseudonym feature on the server side ("no DES here" shows in the 55*a619718eSchristos log file), make sure that you have the "domestic" versions of the 56*a619718eSchristos DES libraries linked. You should see "crypt_d" in "ldd 57*a619718eSchristos /usr/local/bin/pppd". If you see "crypt_i" instead, then make 58*a619718eSchristos sure that /usr/lib/libcrypt.* links to /usr/lib/libcrypt_d.*. (If 59*a619718eSchristos you have the international version of Solaris, then you won't have 60*a619718eSchristos crypt_d. You might want to find an alternative DES library.) 61*a619718eSchristos 62*a619718eSchristos4. Adding the secrets 63*a619718eSchristos 64*a619718eSchristos On the EAP SRP-SHA1 client side, access to the cleartext secret is 65*a619718eSchristos required. This can be done in two ways: 66*a619718eSchristos 67*a619718eSchristos - Enter the client name, server name, and password in the 68*a619718eSchristos /etc/ppp/srp-secrets file. This file has the same format as 69*a619718eSchristos the existing chap-secrets and pap-secrets files. 70*a619718eSchristos 71*a619718eSchristos clientname servername "secret here" 72*a619718eSchristos 73*a619718eSchristos - Use the "password" option in any of the standard 74*a619718eSchristos configuration files (or the command line) to specify the 75*a619718eSchristos secret. 76*a619718eSchristos 77*a619718eSchristos password "secret here" 78*a619718eSchristos 79*a619718eSchristos On the EAP SRP-SHA1 server side, a secret verifier is required. 80*a619718eSchristos This is a one-way hash of the client's name and password. To 81*a619718eSchristos generate this value, run the srp-entry program (see srp-entry(8)). 82*a619718eSchristos This program prompts for the client name and the passphrase (the 83*a619718eSchristos secret). The output will be an entry, such as the following, 84*a619718eSchristos suitable for use in the server's srp-secrets file. Note that if 85*a619718eSchristos this is transferred by cut-and-paste, the entry must be a single 86*a619718eSchristos line of text in the file. 87*a619718eSchristos 88*a619718eSchristospppuser srpserver 0:LFDpwg4HBLi4/kWByzbZpW6pE95/iIWBSt7L.DAkHsvwQphtiq0f6reoUy/1LC1qYqjcrV97lCDmQHQd4KIACGgtkhttLdP3KMowvS0wLXLo25FPJeG2sMAUEWu/HlJPn2/gHyh9aT.ZxUs5MsoQ1E61sJkVBc.2qze1CdZiQGTK3qtWRP6DOpM1bfhKtPoVm.g.MiCcTMWzc54xJUIA0mgKtpthE3JrqCc81cXUt4DYi5yBzeeGTqrI0z2/Gj8Jp7pS4Fkq3GmnYjMxnKfQorFXNwl3m7JSaPa8Gj9/BqnorJOsnSMlIhBe6dy4CYytuTbNb4Wv/nFkmSThK782V:2cIyMp1yKslQgE * 89*a619718eSchristos 90*a619718eSchristos The "secret" field consists of three entries separated by colons. 91*a619718eSchristos The first entry is the index of the modulus and generator from 92*a619718eSchristos SRP's /etc/tpasswd.conf. If the special value 0 is used, then the 93*a619718eSchristos well-known modulus/generator value is used (this is recommended, 94*a619718eSchristos because it is much faster). The second value is the verifier 95*a619718eSchristos value. The third is the password "salt." These latter two values 96*a619718eSchristos are encoded in base64 notation. 97*a619718eSchristos 98*a619718eSchristos For EAP MD5-Challenge, both client and server use the existing 99*a619718eSchristos /etc/ppp/chap-secrets file. 100*a619718eSchristos 101*a619718eSchristos5. Configuration options 102*a619718eSchristos 103*a619718eSchristos There are two main options relating to EAP available for the 104*a619718eSchristos client. These are: 105*a619718eSchristos 106*a619718eSchristos refuse-eap - refuse to authenticate with EAP 107*a619718eSchristos srp-use-pseudonym - use the identity privacy if 108*a619718eSchristos offered by server 109*a619718eSchristos 110*a619718eSchristos The second option stores a pseudonym, if offered by the EAP 111*a619718eSchristos SRP-SHA1 server, in the $HOME/.ppp_pseudonym file. The pseudonym 112*a619718eSchristos is typically an encrypted version of the client identity. During 113*a619718eSchristos EAP start-up, the pseudonym stored in this file is offered to the 114*a619718eSchristos peer as the identity. If this is accepted by the peer, then 115*a619718eSchristos eavesdroppers will be unable to determine the identity of the 116*a619718eSchristos client. Each time the client is authenticated, the server will 117*a619718eSchristos offer a new pseudoname to the client using an obscured (reversibly 118*a619718eSchristos encrypted) message. Thus, access across successive sessions 119*a619718eSchristos cannot be tracked. 120*a619718eSchristos 121*a619718eSchristos There are two main options for EAP on the server: 122*a619718eSchristos 123*a619718eSchristos require-eap - require client to use EAP 124*a619718eSchristos srp-pn-secret "string" - set server's pseudoname secret 125*a619718eSchristos 126*a619718eSchristos The second option sets the long-term secret used on the server to 127*a619718eSchristos encrypt the user's identity to produce pseudonames. The 128*a619718eSchristos pseudoname is constructed by hashing this string with the current 129*a619718eSchristos date (to the nearest day) with SHA1, then using this hash as the 130*a619718eSchristos key for a DES encryption of the client's name. The date is added 131*a619718eSchristos to the hash for two reasons. First, this allows the pseudonym to 132*a619718eSchristos change daily. Second, it allows the server to decode any previous 133*a619718eSchristos pseudonym by trying previous dates. 134*a619718eSchristos 135*a619718eSchristos See the pppd(8) man page for additional options. 136*a619718eSchristos 137*a619718eSchristos6. Comments welcome! 138*a619718eSchristos 139*a619718eSchristos This is still an experimental implementation. It has been tested 140*a619718eSchristos and reviewed carefully for correctness, but may still be 141*a619718eSchristos incomplete or have other flaws. All comments are welcome. Please 142*a619718eSchristos address them to the author: 143*a619718eSchristos 144*a619718eSchristos james.d.carlson@sun.com 145*a619718eSchristos 146*a619718eSchristos or, for EAP itself or the SRP extensions to EAP, to the IETF PPP 147*a619718eSchristos Extensions working group: 148*a619718eSchristos 149*a619718eSchristos ietf-ppp@merit.edu 150