RFC 2943
TELNET Authentication Using DSA
RFC 2943: TELNET Authentication Using DSA 🎀
Okay bestie, this is the cover page. RFC 2943 is called TELNET Authentication Using DSA ✨. It was written by R. Housley, T. Horting, and P. Yee, all from SPYRUS 💅. It's a Standards Track document dated September 2000. The title block doesn't list anything it obsoletes or updates 🌸.
Status of this Memo 📜
This document is an Internet standards track protocol for the Internet community, and it asks for discussion and suggestions for improvements 💜. To find out where this protocol stands in standardization, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🔥. Distribution of this memo is unlimited 🦋.
Copyright Notice ©️
Copyright (C) The Internet Society (2000). All Rights Reserved 🌈.
Abstract 🫶
So this doc defines a telnet authentication mechanism that uses the Digital Signature Algorithm (DSA) [FIPS186] 💖. It's built on top of the Telnet Authentication Option [RFC2941] 🧚.
1. Command Names and Codes 🔢
Here's the full list of numbers and names, copied exactly as the spec has them 🍓:
AUTHENTICATION 37
Authentication Commands:
IS 0
SEND 1
REPLY 2
NAME 3
Authentication Types:
DSS 14
Modifiers:
AUTH_WHO_MASK 1
AUTH_CLIENT_TO_SERVER 0
AUTH_SERVER_TO CLIENT 1
AUTH_HOW_MASK 2
AUTH_HOW_ONE_WAY 0
AUTH_HOW_MUTUAL 2
ENCRYPT_MASK 20
ENCRYPT_OFF 0
ENCRYPT_USING_TELOPT 4
ENCRYPT_AFTER_EXCHANGE 16
ENCRYPT_RESERVED 20
INI_CRED_FWD_MASK 8
INI_CRED_FWD_OFF 0
INI_CRED_FWD_ON 8
Sub-option Commands:
DSS_INITIALIZE 1
DSS_TOKENBA 2
DSS_CERTA_TOKENAB 3
DSS_CERTB_TOKENBA2 42. TELNET Security Extensions 🔐
Okay so, TELNET by itself has zero concept of security 😭. Without any negotiated options, it just shuttles characters back and forth between the NVTs run by the two TELNET processes. In its most common job, which is remote terminal access on TCP port 23, TELNET hooks you up to a server that wants a user name and password sent in the clear 🙈. And the server never proves who it is to you. Not it. Very sus 💀.
The TELNET Authentication Option fixes that by handling user authentication and server authentication 🔥. User authentication can replace the usual host password mechanism or sit alongside it. Server authentication usually happens together with user authentication 🫶.
To get these security services going, the two TELNET entities first have to agree that they're both willing to use the TELNET Authentication Option ✨. Once they agree, they can run sub-option negotiations to pick the authentication protocol and, if needed, the remote user name used for authorization checks 💅.
Authentication and parameter negotiation happen over an unbounded series of exchanges 🌀. The server offers a preference-ordered list of the authentication types (mechanisms) it supports 🍓. Each mechanism also comes with a modifier saying whether the auth is one-way or mutual, and which direction it runs in 💜. The client picks one mechanism from that list and replies with its choice, along with the first set of authentication data that the chosen type needs 🦋. Then the server and client keep going through however many rounds it takes to finish the authentication 🌈.
3. Use of Digital Signature Algorithm (DSA) 🔏
DSA is also called the Digital Signature Standard (DSS), and people use those names interchangeably 🎀. This paper describes how DSA can deliver certain security services when it's paired with the TELNET Authentication Option ✨. The hash is SHA-1 [FIPS180-1], used together with DSA [FIPS186] 💖.
DSA can give you either unilateral or mutual authentication 🧚. TELNET works character by character, so it isn't a good fit for integrity-only services 🙈. That means this DSA profile provides authentication but does not provide session integrity 💀. The token and exchanges follow NIST FIPS PUB 196 [FIPS196], which is the Standard for Public Key Cryptographic Entity Authentication Mechanisms, including Appendix A on ASN.1 encoding of messages and tokens 📜. All data covered by a digital signature must be encoded using the Distinguished Encoding Rules (DER) 🔥. Other data may use either the Basic Encoding Rules (BER) or DER [X.208] 🌸.
3.1. Unilateral Authentication with DSA 🫶
Unilateral authentication must be done client-to-server 💅. What comes next are the protocol steps needed to do DSA authentication as FIPS PUB 196 describes, inside the TELNET Authentication Option framework ✨. If a failure happens, the return codes follow the ones the TELNET Authentication Option specifies 😭. They aren't listed here, because they're the same across every mechanism 🦋. FIPS PUB 196 uses a set of exchanges that get passed around to provide authentication 🌈. Each exchange has various fields and tokens, and some of them are optional. Each token also has subfields, and some of those are optional too 🍓. The spec picks a conformant subset of those fields and subfields 💜. The tokens are ASN.1 encoded as Appendix A of FIPS PUB 196 defines, and each token is named after the direction it flows. For example, TokenBA flows from Party B to Party A 🧚. All data covered by a digital signature must be encoded using the Distinguished Encoding Rules (DER) 🔏. Data that isn't covered by a digital signature may use either the Basic Encoding Rules (BER) or DER [X.208] 💖. Figure 1 shows the exchanges for unilateral authentication 🎀.
During authentication, the client can give the server a user name using the authentication name sub-option ✨. If the name sub-option isn't used, the server will usually ask for a name and password in the clear 🙈. The name sub-option must be sent after the server sends its list of supported authentication types, and before the client finishes the authentication exchange. That timing is what makes sure the server won't prompt for a user name and password 🔥. In Figure 1, the name sub-option goes out right after the server presents the list 🫶.
For one-way DSS authentication, the two-octet authentication type pair is DSS AUTH_CLIENT_TO_SERVER | AUTH_HOW_ONE_WAY | ENCRYPT_OFF | INI_CRED_FWD_OFF. This means DSS authentication authenticates the client to the server, and no encryption happens 💅.
CertA is the client's certificate ✨. Both certificates are X.509 certificates that carry DSS public keys [RFC2459] 🌸. The client must validate the server's certificate before it uses the DSA public key inside it 💜.
An unbounded authentication exchange is way easier to implement when each part of it carries a unique identifier 🧚. So each exchange carries a single-octet sub-option identifier right after the two-octet authentication type pair 🦋.
The exchanges in Figure 1 assume you already know FIPS PUB 196 and the TELNET Authentication Option 🌈. The client is Party A, and the server is Party B 🍓. When the exchanges finish, the client has been authenticated to the server 👑.
------------------------------------------------------------------
Client (Party A) Server (Party B)
<-- IAC DO AUTHENTICATION
IAC WILL AUTHENTICATION -->
<-- IAC SB AUTHENTICATION SEND
<list of authentication options>
IAC SE
IAC SB AUTHENTICATION
NAME <user name> -->
IAC SB AUTHENTICATION IS
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_ONE_WAY |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_INITIALIZE
IAC SE -->
<-- IAC SB AUTHENTICATION REPLY
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_ONE_WAY |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_TOKENBA
Sequence( TokenID, TokenBA )
IAC SE
IAC SB AUTHENTICATION IS
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_ONE_WAY |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_CERTA_TOKENAB
Sequence( TokenID, CertA, TokenAB )
IAC SE -->
------------------------------------------------------------------
Figure 13.2. Mutual Authentication with DSA 🤝
Mutual authentication is a little more involved 💖. Figure 2 shows how the exchanges go 🎀.
For mutual DSS authentication, the two-octet authentication type pair is DSS AUTH_CLIENT_TO_SERVER | AUTH_HOW_MUTUAL | ENCRYPT_OFF | INI_CRED_FWD_OFF. This means DSS authentication is used to mutually authenticate the client and the server, and no encryption happens 🔥.
---------------------------------------------------------------------
Client (Party A) Server (Party B)
IAC WILL AUTHENTICATION -->
<-- IAC DO AUTHENTICATION
<-- IAC SB AUTHENTICATION SEND
<list of authentication options>
IAC SE
IAC SB AUTHENTICATION
NAME <user name> -->
IAC SB AUTHENTICATION IS
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_INITIALIZE
IAC SE -->
<-- IAC SB AUTHENTICATION REPLY
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_TOKENBA
Sequence( TokenID, TokenBA )
IAC SE
Client (Party A) Server (Party B)
IAC SB AUTHENTICATION IS
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_CERTA_TOKENAB
Sequence( TokenID, CertA, TokenAB )
IAC SE -->
<-- IAC SB AUTHENTICATION REPLY
DSS
AUTH_CLIENT_TO_SERVER |
AUTH_HOW_MUTUAL |
ENCRYPT_OFF |
INI_CRED_FWD_OFF
DSS_CERTB_TOKENBA2
Sequence( TokenID, CertB,
TokenBA2 )
IAC SE---------------------------------------------------------------------
Figure 24. ASN.1 Syntax ✨
Okay so, remember how I said we'd only use a conformant subset of the fields and subfields from FIPS PUB 196? 🎀 This section is where that subset gets its ASN.1 syntax, so you can actually see the shape of everything.
Figure 1 and Figure 2 show these structures too. To match each figure reference to its ASN.1 definition, use this table 🦋
Figure 1 Sequence( TokenID, TokenBA ) MessageBA
Sequence( TokenID, CertA, TokenAB ) MessageAB
Figure 2 Sequence( TokenID, TokenBA ) MessageBA
Sequence( TokenID, CertA, TokenAB ) MessageAB
Sequence( TokenID, CertB, TokenBA2 ) MessageBA2Now the definitions. The conformant subset of FIPS 196 is written out below. To keep things simple, no optional fields or subfields are included. 💖 CertificationPath comes from CCITT Recommendation X.509 [X.509], and Name comes from CCITT Recommendation X.501 [X.501]. Those definitions aren't repeated here. Also, every DSA signature value is encoded as a sequence of two integers, following the same conventions as RFC 2459, section 7.2.2. Iconic. 👑
MessageBA ::= SEQUENCE {
tokenId [0] TokenId,
tokenBA TokenBA }
TokenBA ::= SEQUENCE {
ranB RandomNumber,
timestampB TimeStamp }
MessageAB ::= SEQUENCE {
tokenId [0] TokenId,
certA [1] CertData,
tokenAB TokenAB }
TokenAB ::= SEQUENCE {
ranA RandomNumber,
ranB RandomNumber,
entityB EntityName,
timestampB TimeStamp,
absigValue OCTET STRING }
MessageBA2 ::= SEQUENCE {
tokenId [0] TokenId,
certB [1] CertData,
tokenBA2 TokenBA2 }
TokenBA2 ::= SEQUENCE {
ranB [0] RandomNumber,
ranA [1] RandomNumber,
entityA EntityName,
timestampB2 TimeStamp,
ba2sigValue OCTET STRING }
CertData ::= SEQUENCE {
certPath [0] CertificationPath } -- see X.509
EntityName ::= SEQUENCE OF CHOICE { -- only allow one!
directoryName [4] Name } -- see X.501
RandomNumber ::= INTEGER -- 20 octets
TokenId ::= SEQUENCE {
tokenType INTEGER, -- see table below
protoVerNo INTEGER } -- always 0x0001
TimeStamp ::= GeneralizedTimeTokenId.TokenType is the field that tells you two things: what kind of message you're looking at, and whether the authentication is unilateral or mutual. 🌸 Here's the lookup table you need to implement this spec:
Message Type Authentication Type TokenId.TokenType
MessageBA Unilateral 0x0001
Mutual 0x0011
MessageAB Unilateral 0x0002
Mutual 0x0012
MessageBA Mutual 0x00135. Security Considerations 💅
Bestie, this whole memo is about security mechanisms, so this is the part to read twice 😭 For DSA to actually provide the authentication we've been talking about, the implementation has to protect the private key from disclosure. No leaks. Period.
Implementations must randomly generate DSS private keys, the 'k' values used in DSS signatures, and nonces. If you use inadequate pseudo-random number generators (PRNGs) to make these values, you can end up with little or no security. 💀 An attacker may find it way easier to recreate the PRNG environment that produced the values and then search through the small set of possibilities, instead of doing a brute force search. Generating quality random numbers is genuinely hard, so the guidance is worth reading: RFC 1750 [RFC1750] has important guidance in this area, and Appendix 3 of FIPS PUB 186 [FIPS186] describes one quality PRNG technique. 🔥
6. Acknowledgements 🫶
We'd like to thank William Nace for support during implementation of this specification. Literally couldn't have done it without the squad 💜
7. IANA Considerations 🎀
The authentication type DSS and its associated suboption values are registered with IANA. Any suboption values used to extend the protocol as described in this document must be registered with IANA before use. Also, IANA has been told not to issue new suboption values unless documentation of their use has been submitted first. Paperwork first, slay later 📝✨
8. References 📚
FIPS180-1 Secure Hash Standard. FIPS Pub 180-1. April 17, 1995.
<http://csrc.nist.gov/fips/fips180-1.pdf>
FIPS186 Digital Signature Standard (DSS). FIPS Pub 186. May 19,
1994. <http://csrc.nist.gov/fips/fips186.pdf>
FIPS196 Standard for Entity Authentication Using Public Key
Cryptography. FIPS Pub 196. February 18, 1997.
<http://csrc.nist.gov/fips/fips196.pdf>
RFC1750 Eastlake, 3rd, D., Crocker, S. and J. Schiller, "Randomness
Recommendations for Security", RFC 1750, December 1994.
RFC2459 Housley, R., Ford, W., Polk, W. and D. Solo, "Internet
X.509 Public Key Infrastructure: X.509 Certificate and CRL
Profile", RFC 2459, January 1999.
RFC2941 T'so, T. and J. Altman, "Telnet Authentication Option", RFC
2941, September 2000.
X.208 CCITT. Recommendation X.208: Specification of Abstract
Syntax Notation One (ASN.1). 1988.
X.501 CCITT. Recommendation X.501: The Directory - Models. 1988.
X.509 CCITT. Recommendation X.509: The Directory -
Authentication Framework. 1988.9. Authors' Addresses 🧚
Meet the SPYRUS crew who built this 💖
Russell Housley
SPYRUS
381 Elden Street, Suite 1120
Herndon, VA 20172
USA
EMail: housley@spyrus.com
Todd Horting
SPYRUS
381 Elden Street, Suite 1120
Herndon, VA 20172
USA
EMail: thorting@spyrus.com
Peter Yee
SPYRUS
5303 Betsy Ross Drive
Santa Clara, CA 95054
USA
EMail: yee@spyrus.com10. Full Copyright Statement ⭐
Copyright (C) The Internet Society (2000). All Rights Reserved. 🌈
This document and translations of it may be copied and furnished to others. Derivative works that comment on or otherwise explain it, or help with its implementation, may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind. The one catch is that the above copyright notice and this paragraph must be included on all such copies and derivative works. 👀 But this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. The exceptions are when it's needed for developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed, or when it's needed to translate it into languages other than English.
The limited permissions above are perpetual and will not be revoked by the Internet Society or its successors or assigns. Forever and ever 🦋
This document and the information in it are provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🙈
Acknowledgement 🍓
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society 💜
📦 where this page comes from
- ietf: rfc2943 2000-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms