RFC 8146
Adding Support for Salted Password Databases to EAP-pwd
RFC 8146: Adding Support for Salted Password Databases to EAP-pwd ✨
Okay bestie, so this is RFC 8146 🎀, written by D. Harkins at HP Enterprise and dated April 2017. It's Informational, which means it's published for info and isn't a Standards Track spec 📚. It has ISSN 2070-1721, and it updates RFC 5931 💅. The IETF put it out, so it's a community-approved doc 🫶
Abstract
EAP-pwd is an Extensible Authentication Protocol (EAP) method 🦋 that uses a shared password to authenticate, and it does it in a way that holds up against dictionary attacks 🔥. It supports raw keys and double hashing in the style of Microsoft Challenge Handshake Authentication Protocol version 2 (MSCHAPv2) 💖, but it does NOT support salted passwords yet 😭. There are a ton of existing salted password databases out there, so it's super desirable to let EAP-pwd use them 🌈
Status of This Memo
Real talk, this doc is not an Internet Standards Track spec. It's just published for informational purposes 📖
It's a product of the IETF 🌸, which means it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG) ✨. Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 7841 if you want the deets 🧚
For current status, errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc8146 🔗
Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved 💜
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were in effect on the publication date 📜. Please actually read these, because they spell out your rights and restrictions for this doc 🙈. Code Components pulled out of this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License 🫶
Table of Contents
1. Introduction ....................................................3
1.1. Background .................................................3
1.2. Keyword Definition .........................................3
2. Salted Passwords in EAP-pwd .....................................3
2.1. Password Preprocessing .....................................3
2.2. The Salting of a Password ..................................5
2.3. Using UNIX crypt ...........................................5
2.4. Using scrypt ...............................................6
2.5. Using PBKDF2 ...............................................6
2.6. Protocol Modifications .....................................7
2.7. Payload Modifications ......................................8
3. IANA Considerations .............................................8
4. Security Considerations .........................................9
5. References ......................................................9
5.1. Normative References .......................................9
5.2. Informative References ....................................10
Acknowledgements ..................................................11
Author's Address ..................................................111. Introduction ✨
1.1. Background
Okay so, databases of stored passwords are a major target 🎯. If an attacker gets into the database, they just learn the passwords. To stop that, someone came up with the idea of hashing the password with a random "salt" and then storing the resulting digest along with the salt, instead of the raw password 🧂. This randomizes the password, so even if two distinct users picked the same password, the stored, salted version will be different 🌸. It also means an attacker who breaks into the stored database has to run a dictionary attack on each entry separately to recover passwords 🕵️♀️
Dictionary attacks, especially ones using custom hardware, are real-world attacks 💀. Just salting a password is NOT enough to protect a password database 🙅♀️. To deal with these attacks, a sequential memory hard function, like the one described in [RFC7914], gets used 💪
Even though salting alone doesn't handle a lot of real-world attacks, salting was historically super popular, so there are a LOT of these databases deployed 📦. EAP-pwd needs to be able to support them 🫶. On top of that, EAP-pwd also needs to support databases that use more modern sequential memory hard functions for protection 🦋
EAP-pwd puts an extra security requirement on a salted password database that wouldn't exist otherwise, so see Section 4 for that 👀
1.2. Keyword Definition
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖✨
2. Salted Passwords in EAP-pwd
2.1. Password Preprocessing
EAP-pwd is based on the "dragonfly" Password-Authenticated Key Exchange (PAKE), see [RFC7664] 🐉. It's a balanced PAKE, and it requires that each party end up with an identical representation of a processed password (see Section 4) 🔐. So salting a password gets treated as an extra password preprocessing technique for EAP-pwd 🧁. The server conveys the salt and digest to use to the peer, and the password gets processed before the password element is fixed (see Section 2.8.3 of [RFC5931]) 💅
This memo defines eight (8) new password preprocessing techniques for EAP-pwd 🎀. Here they are, bestie:
0x03: a random salt with SHA-10x04: a random salt with SHA-2560x05: a random salt with SHA-5120x06: UNIX crypt()0x07: scrypt0x08: PBKDF2 with SHA-2560x09: PBKDF2 with SHA-5120x0A: SASLprep then a random salt with SHA-10x0B: SASLprep then a random salt with SHA-2560x0C: SASLprep then a random salt with SHA-5120x0D: SASLprep then UNIX crypt()0x0E: OpaqueString then scrypt0x0F: OpaqueString then PBKDF2 with SHA-2560x10: OpaqueString then PBKDF2 with SHA-512
When you pass a salt, the salt SHOULD be at least as long as the message digest of the hash algorithm being used 🧂. Nobody can promise deployed salted databases followed this rule, though 😬. For interoperability's sake, an EAP peer SHOULD NOT abort an EAP-pwd exchange just because the salt conveyed during the exchange is shorter than the message digest of the indicated hash algorithm 🫶
UNIX crypt() ([CRY]), scrypt ([RFC7914]), and PBKDF2 ([RFC8018]) all come with extra formatting requirements for the passed salt 📋. Check below for those 💖
Plain salting techniques using [SHS] are included so existing databases still work 🦋. scrypt and PBKDF2 techniques are RECOMMENDED for new password database deployments 🌟
SASLprep has been deprecated, but databases treated with SASLprep still exist, so code points for them are necessary 😭. When using SASLprep, a password SHALL be considered a "stored string" per [RFC3454], which means unassigned code points are prohibited 🚫. The output of SASLprep SHALL be the binary representation of the processed UTF-8 character string 💜. Prohibited output and unassigned code points that show up during SASLprep preprocessing SHALL cause a failure of preprocessing, and the output SHALL NOT be used with EAP-pwd 💀
When doing one of the preprocessing techniques (0x0E-0x10), the password SHALL be a UTF-8 string, and it SHALL be preprocessed by applying the Preparation and Enforcement steps of the OpaqueString profile in [RFC7613] to the password 🌈. The output of OpaqueString, which is also a UTF-8 string, becomes the EAP-pwd password and SHALL be hashed with the indicated algorithm ✨
There are a lot of deployed password databases that use salting and hashing in the style of [RFC7616] 🍓. Those deployments need a nonce contribution from the client (as well as the server), though, and EAP-pwd just doesn't have a way to provide that information 😩
2.2. The Salting of a Password
For both parties to derive the same salted password, there needs to be a canonical way of salting a password 🔑. When using EAP-pwd, a password SHALL be salted by hashing the password followed by the salt, using the designated hash function:
salted-password = Hash(password | salt)The server stores the salted-password and the salt in its database, and the client derives the salted password on the fly 🧚
2.3. Using UNIX crypt
UNIX crypt() supports different algorithms 🌸. The algorithm in use gets indicated by prepending an encoding of "setting" to the passed salt. EAP-pwd doesn't care which algorithm it is, because the entire salt, encoded "setting" included, gets passed along as an opaque string for crypt() to interpret 🫠. The salted password used for EAP-pwd SHALL be the output of crypt() 🎀:
salted-password = crypt(password, salt)The server stores the salted-password, plus the encoded algorithm and salt, in its database, and the client derives the salted-password on-the-fly 💅
If the server indicates a crypt() algorithm that the client doesn't support, the exchange fails and the client MUST terminate the connection. That's a hard stop, bestie 🚨
2.4. Using scrypt
The scrypt function takes several parameters 🧪:
- N, the cost parameter
- r, the block size
- p, the parallelization parameter
- dkLen, the length of the output
These parameters get encoded into the "salt" field of the modified EAP-pwd message 📨. Parameters r and dkLen SHALL be 16-bit integers in network order 🔢. The other parameters SHALL each be 32-bit integers in network order. So the "salt" field that gets transmitted in EAP-pwd SHALL be:
N || r || p || dkLen || saltwhere || represents concatenation 🧵
The value of N is the exponent you raise two to, which sets the CPU/Memory cost of scrypt. In other words, the value is 2^N 🧠. Per [RFC7914], the resulting CPU/Memory cost value SHALL be less than 2^(128 * r / 8), and the value of p SHALL be less than or equal to ((2^32 - 1) * 32) / (128 * r) 📐
Note: EAP-pwd uses the salted password directly as the authentication credential, and it hashes that with a counter to get a secret element in a finite field 🧩. So it makes little sense to use a dkLen bigger than the length of the digest produced by the underlying hash function 🤷♀️. The capability is there to do it anyway 🦋
2.5. Using PBKDF2
The PBKDF2 function needs two parameters 🧮:
- c, the iteration count
- dkLen, the length of the output
These parameters get encoded into the "salt" field of the modified EAP-pwd message 📨. The parameters SHALL be 16-bit integers in network order 🔢. So the "salt" field that gets transmitted in EAP-pwd SHALL be:
c || dkLen || saltwhere || represents concatenation 🧵
Note: EAP-pwd uses the salted password directly as the authentication credential, and it hashes that with a counter to get a secret element in a finite field 🧩. So it makes little sense to use a dkLen bigger than the length of the digest produced by the underlying hash function 💅. The capability is provided anyway ✨
2.6. Protocol Modifications 🎀
Okay so like all EAP methods, EAP-pwd is server initiated, and the initial identity the client sends is not useful for authentication purposes 🙈 Because of this, the server is required to show its hand, including which password preprocessing it wants to use, before it knows who the client really is. This means the server can't support multiple salt digests at the same time in one password database 😭 To support multiple salt digests at once, you need multiple password databases, and you use the routable portion of the client identity to pick one when starting EAP-pwd. It's giving organization 💅
The server uses the EAP-pwd-ID/Request to say which password preprocessing technique it's using. The client says yes to that technique and identifies itself in the EAP-pwd-ID/Response. If the client doesn't accept any of the offered preprocessing techniques, it SHALL terminate the exchange ❌ Once the server gets the EAP-pwd-ID/Response, it knows who the client is and can look up the client's salted password and the salt in the database. The server then adds the length of the salt and the salt itself to the EAP-pwd-Commit/Request message (see Section 2.7) ✨
The server can fix the password element (Section 2.8.3 of [RFC5931]) as soon as it has looked up the salted password in the database. The client, though, is required to wait until it receives the server's EAP-pwd-Commit/Request before it starts fixing the password element 🦋
2.7. Payload Modifications 🌸
When a salted password preprocessing technique gets agreed on during the EAP-pwd-ID exchange, the EAP-pwd-Commit payload gets a glow-up 💖 It now includes the salt and salt length (see Figure 1). The server passes the salt and salt length in the EAP-pwd-Commit/Request. The client's EAP-pwd-Commit/Response stays the same, and it MUST NOT echo the salt length and salt in its EAP-pwd-Commit/Response. No copying the homework, bestie 🙅♀️
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Salt-len | |
+-+-+-+-+-+-+-+-+ ~
~ Salt +-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~
| |
~ Element ~
| |
~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~
| |
~ Scalar +-+-+-+-+-+-+-+-+
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Salted EAP-pwd-Commit/RequestThe salt-len field SHALL be non-zero, and it tells you the length, in octets, of the salt that follows 📏 The Salt field SHALL be a binary string. The Element and Scalar are encoded according to Section 3.3 of [RFC5931] 🧚
Note: when a non-salted password preprocessing method is used, for example, any of the methods from [RFC5931], the EAP-pwd-Commit payload MUST NOT be modified to include the salt and salt length. Don't add salt where there isn't any, periodt 🙅♀️
3. IANA Considerations 🌈
IANA has allocated fourteen (14) values from the "password preprocessing method registry" established by [RFC5931]. Fourteen new values, iconic 👑
4. Security Considerations 💀
Okay this section is serious, so grab your snacks 🍓 EAP-pwd requires each side to produce an identical representation of the (processed) password before the password element can be fixed. This symmetry undercuts one of the benefits of salting a password database, because the salted password from a compromised database can be used directly to impersonate the EAP-pwd client. The plaintext password doesn't need to be recovered, so no dictionary attack is needed 😱 While the immediate effect of such a compromise would be a compromise of the server, the per-user salt would still stop the adversary from recovering the password, barring a successful dictionary attack, to use for other purposes. So the salt is still doing real work, even if it's not a full shield 🛡️
Salted password databases used with EAP-pwd MUST be afforded the same level of protection as databases of plaintext passwords. Same vibes, same locks, no exceptions 🔒
Hashing a password with a salt increases the work factor for an attacker to get the cleartext password, but dedicated hardware makes this increased work factor increasingly negligible in real-world scenarios. Cleartext password databases SHOULD be protected with a scheme that uses a sequential memory hard function such as [RFC7914] 🧠
EAP-pwd sends the salt in the clear. If EAP-pwd is not tunneled inside another, encrypting, EAP method, an adversary that can observe traffic from the server to the authenticator, or from the authenticator to the client, would learn the salt used for a particular user 👀 Knowing a salt might feel kind of dubious as a flex. The pre-image resistance of the hash function used protects the client's password, and as noted above, the database of salted passwords still has to be protected from disclosure. Even so, it's still potential extra meta-data in the hands of an untrusted third party, and that's a whole mood 😤
5. References 📚
5.1. Normative References ✨
[CRY] Linux Programmer's Manual, "CRYPT(3)", August 2015, <http://man7.org/linux/man-pages/man3/crypt.3.html>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>.
[RFC3454] Hoffman, P. and M. Blanchet, "Preparation of Internationalized Strings ("stringprep")", RFC 3454, DOI 10.17487/RFC3454, December 2002, <http://www.rfc-editor.org/info/rfc3454>.
[RFC5931] Harkins, D. and G. Zorn, "Extensible Authentication Protocol (EAP) Authentication Using Only a Password", RFC 5931, DOI 10.17487/RFC5931, August 2010, <http://www.rfc-editor.org/info/rfc5931>.
[RFC7613] Saint-Andre, P. and A. Melnikov, "Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords", RFC 7613, DOI 10.17487/RFC7613, August 2015, <http://www.rfc-editor.org/info/rfc7613>.
[RFC7914] Percival, C. and S. Josefsson, "The scrypt Password-Based Key Derivation Function", RFC 7914, DOI 10.17487/RFC7914, August 2016, <http://www.rfc-editor.org/info/rfc7914>.
[RFC8018] Moriarty, K., Ed., Kaliski, B., and A. Rusch, "PKCS #5: Password-Based Cryptography Specification Version 2.1", RFC 8018, DOI 10.17487/RFC8018, January 2017, <http://www.rfc-editor.org/info/rfc8018>.
[SHS] National Institute of Standards and Technology, "Secure Hash Standard (SHS)", FIPS PUB 180-4, DOI 10.6028/NIST.FIPS.180-4, August 2015, <http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf>.
5.2. Informative References 💜
[RFC7616] Shekh-Yusef, R., Ed., Ahrens, D., and S. Bremer, "HTTP Digest Access Authentication", RFC 7616, DOI 10.17487/RFC7616, September 2015, <http://www.rfc-editor.org/info/rfc7616>.
[RFC7664] Harkins, D., Ed., "Dragonfly Key Exchange", RFC 7664, DOI 10.17487/RFC7664, November 2015, <http://www.rfc-editor.org/info/rfc7664>.
Acknowledgements 🫶
Thanks to Stefan Winter and the eduroam project for their continued interest in using EAP-pwd. Thanks to Simon Josefsson for his advice on support for scrypt and PBKDF2. Real ones, all of them 🌟
Author's Address 🦋
Dan Harkins HP Enterprise 3333 Scott Boulevard Santa Clara, CA 95054 United States of America
Email: dharkins@arubanetworks.com
📦 where this page comes from
- ietf: rfc8146 2017-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms