idnits 2.17.1 draft-ietf-otp-ext-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Cannot find the required boilerplate sections (Copyright, IPR, etc.) in this document. Expected boilerplate is as follows today (2024-04-23) according to https://trustee.ietf.org/license-info : IETF Trust Legal Provisions of 28-dec-2009, Section 6.a: This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 2: Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved. IETF Trust Legal Provisions of 28-dec-2009, Section 6.b(i), paragraph 3: This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** Missing expiration date. The document expiration date should appear on the first and last page. ** The document seems to lack a 1id_guidelines paragraph about Internet-Drafts being working documents. ** The document seems to lack a 1id_guidelines paragraph about 6 months document validity. ** The document seems to lack a 1id_guidelines paragraph about the list of current Internet-Drafts. ** The document seems to lack a 1id_guidelines paragraph about the list of Shadow Directories. == No 'Intended status' indicated for this document; assuming Proposed Standard == The page length should not exceed 58 lines per page, but there was 1 longer page, the longest (page 1) being 59 lines Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an Introduction section. ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. ** There are 4 instances of too long lines in the document, the longest one being 6 characters in excess of 72. ** The abstract seems to contain references ([RFC1938]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 64: '...ast one token of data MUST be present....' RFC 2119 keyword, line 91: '... 1. MUST be able to receive and par...' RFC 2119 keyword, line 93: '... 2. MUST process the type field in ...' RFC 2119 keyword, line 94: '... 3. MUST reject any authentication ...' RFC 2119 keyword, line 96: '... 4. SHOULD provide an appropriate i...' (40 more instances...) Miscellaneous warnings: ---------------------------------------------------------------------------- -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (November 1, 1996) is 10035 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'RFC 1938' is mentioned on line 33, but not defined ** Obsolete undefined reference: RFC 1938 (Obsoleted by RFC 2289) == Missing Reference: 'RFC822' is mentioned on line 46, but not defined ** Obsolete undefined reference: RFC 822 (Obsoleted by RFC 2822) == Missing Reference: 'RFC1825' is mentioned on line 269, but not defined ** Obsolete undefined reference: RFC 1825 (Obsoleted by RFC 2401) == Unused Reference: 'RFC 822' is defined on line 397, but no explicit reference was found in the text == Unused Reference: 'RFC 1825' is defined on line 401, but no explicit reference was found in the text == Unused Reference: 'RFC1938' is defined on line 405, but no explicit reference was found in the text ** Obsolete normative reference: RFC 822 (Obsoleted by RFC 2822) ** Obsolete normative reference: RFC 1825 (Obsoleted by RFC 2401) ** Obsolete normative reference: RFC 1938 (Obsoleted by RFC 2289) Summary: 18 errors (**), 0 flaws (~~), 8 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 INTERNET DRAFT Craig Metz 3 draft-ietf-otp-ext-01.txt Kaman Sciences 4 November 1, 1996 6 OTP Extended Responses 8 STATUS OF THIS MEMO 10 This document is an Internet Draft. Internet Drafts are working 11 documents of the Internet Engineering Task Force (IETF), its Areas 12 and Working Groups. Note that other groups may also distribute 13 working documents as Internet Drafts. 15 Internet Drafts are draft documents valid for a maximum of six 16 months. Drafts may be updated, replaced, or obsoleted by other 17 documents at any time. It is not appropriate to use Internet Drafts 18 as reference material or to cite them other than as a "working 19 draft" or "work in progress." 21 To learn the current status of any Internet Draft, please check the 22 1id-abstracts.txt listing contained in the Internet-Drafts Shadow 23 Directories on ftp.is.co.za (Africa), ds.internic.net (US East 24 Coast), nic.nordu.net (Europe), ftp.isi.com (US West Coast), or 25 munnari.oz.au (Pacific Rim). 27 The distribution of this Internet Draft is unlimited. It is filed as 28 and it expires on May 1, 1997. 30 1.0 ABSTRACT 32 This document provides a specification for a type of response to an 33 OTP [RFC 1938] challenge that carries explicit indication of the 34 response's encoding. Codings for the two mandatory OTP data formats 35 using this new type of response are presented. This document also 36 provides a specification for a response that allows OTP generator to 37 request that a server re-initialize a sequence and change parameters 38 such as the secret pass phrase. 40 2.0 CONVENTIONS, TERMS, and NOTATION 42 This document specifies the data formats and software behaviors 43 needed to use OTP extended responses. The data formats are described 44 three ways: using an ad-hoc UNIX manual page style syntax, using 45 augmented BNF described in sections two and three of RFC 46 822[RFC822], and by examples. Should there be any conflict between 47 these descriptions, the augmented BNF takes precedence. The software 48 behaviors are described in words, and specific behavior compliance 49 requirements are itemized using the requirements terminology 50 described in section four of RFC 1938. 52 3.0 EXTENDED RESPONSES 54 This document builds on the protocol and terminology specified in 55 RFC 1938 and assumes that you have already read this document and 56 understand its contents. 58 An extended response is a single line of printable text terminated 59 by a new line sequence appropriate for the context of its use (e.g., 60 ASCII CR followed by ASCII LF). It contains two or more tokens that 61 are separated with a single colon (':') character. The first token 62 contains a type specifier that indicates the format of the rest of 63 the response. The tokens that follow are argument data for the OTP 64 extended response. At least one token of data MUST be present. 66 Syntax 68 In UNIX manual page like syntax, the general form of an extended 69 response could be described as: 71 :[:[:...]] 73 In augmented BNF syntax, the syntax of the general form of an 74 extended response is: 76 extended-response = type 1*(":" argument) newline 77 type = token 78 argument = token 79 token = 1* 80 newline = CRLF / CR / LF / 82 An example of the extended response using a mythical type named 83 "foo" is: 85 foo:some data:some more data:12345 87 Requirements 89 A server compliant with this specification: 91 1. MUST be able to receive and parse the general form of an extended 92 response 93 2. MUST process the type field in a case-insensitive manner 94 3. MUST reject any authentication attempt using an extended response 95 if it does not support that type of response 96 4. SHOULD provide an appropriate indication to the generator if the 97 response was rejected because of (3) 98 5. MUST limit the length of the input reasonably 99 6. MUST accept otherwise arbitrary amounts of whitespace wherever a 100 response allows it 101 7. MUST be able to receive and correctly process standard OTP 102 responses 104 A generator compliant with this specification: 106 1. SHOULD have an option that selects whether standard or extended 107 responses are generated 108 2. SHOULD make (1) easily available to the end user 109 3. SHOULD be configurable on a per-server or per-seed basis 110 4. MUST be able to generate standard OTP responses 111 5. SHOULD initially default to using standard responses 112 6. MUST generate the type field in lower case 114 4.0 THE "HEX" AND "WORD" RESPONSES 116 There exists a very rare case in which a standard OTP response could 117 be a valid coding in both the hexadecimal and six-word formats. An 118 example of this is the response "ABE ACE ADA ADD BAD A." The 119 solution to this problem mandated by the OTP specification is that 120 compliant servers MUST attempt to parse and verify a standard 121 response in both hexadecimal and six-word formats and must consider 122 the authentication successful if either succeeds. 124 This problem can be solved easily using extended responses. The 125 "hex" response and the "word" response are two response types that 126 encode an OTP in an extended response that explicitly describes the 127 encoding. These responses start with a type label of "hex" for a 128 hexadecimal OTP and "word" for a six-word coded OTP. These responses 129 contain one argument field that contains a standard OTP response 130 coded in the indicated format. 132 Syntax 134 In UNIX manual page like syntax, the format of these responses could 135 be described as: 137 hex: 138 word: 140 In augmented BNF syntax and with the definitions already provided, 141 the syntax of these responses is: 143 hex-response = "hex:" hex-64bit newline 144 hex-64bit = 16(hex-char *LWSP-char) 145 hex-char = ("A" / "B" / "C" / "D" / "E" / "F" / 146 "a" / "b" / "c" / "d" / "e" / "f" / 147 "0" / "1" / "2" / "3" / "4" / "5" / 148 "6" / "7" / "8" / "9") 150 word-response = "word:" word-64bit newline 151 word-64bit = 6(otp-word 1*LWSP-char) 152 otp-word = 154 Examples of these responses are: 156 hex:8720 33d4 6202 9172 word:VAST SAUL TAKE SODA SUCH BOLT 158 Requirements 160 A server compliant with this specification: 162 1. MUST treat all arguments in a case-insensitive manner 164 A generator compliant with this specification: 166 1. MUST generate otp-word tokens in upper case with single spaces 167 separating them 168 2. MUST generate hexadecimal numbers using only lower case for 169 letters 171 5.0 THE "INIT" AND "INIT-WORD" RESPONSES 173 The OTP specification requires that implementations provide a means 174 for a client to re-initialize or change its OTP information with a 175 server but does not require any specific protocol for doing it. 176 Implementations that support the OTP extended responses described in 177 this document MUST support the response with the "init" and "init- 178 word" type specifiers, which provide a standard way for a client to 179 re-initialize its OTP information with a server. This response is 180 intended to be used only by automated clients. Because of this, the 181 primary form of this reponse uses the hexadecimal encoding for 182 binary data. It is possible for a user to type in an "init" or 183 "init-word" response. However, there is enough data that would need 184 to be typed that the six-word coding does not make typing this 185 response much easier. 187 Syntax 189 In UNIX manual page like syntax, the format of these responses could 190 be described as: 192 init:::[::] 193 init-word:::[::] 196 In augmented BNF syntax and with the definitions already provided, 197 the syntax of the "init" response is: 199 init-response = "init:" old-OTP ":" new-params ":" new-OTP 200 1*0(":" check-update ":" check-value) newline 202 old-OTP = hex-64bit 203 new-OTP = hex-64bit 204 check-update = hex-64bit 205 check-value = hex-64bit 207 new-params = algorithm SPACE sequence-number SPACE seed 208 algorithm = "md4" / "md5" / "sha1" 209 sequence-number = 4*3DIGIT 210 seed = 16*1(ALPHA / DIGIT) 212 In augmented BNF syntax and with the definitions already provided, 213 the syntax of the "init-word" response is: 215 init-word-response = "init-word:" old-OTP ":" new-params ":" new-OTP 216 1*0(":" check-update ":" check-value) newline 218 old-OTP = word-64bit 219 new-OTP = word-64bit 220 check-update = word-64bit 221 check-value = word-64bit 223 new-params = algorithm SPACE sequence-number SPACE seed 224 algorithm = "md4" / "md5" / "sha1" 225 sequence-number = 4*3DIGIT 226 seed = 16*1(ALPHA / DIGIT) 228 Note that all appropriate fields for the "init" response MUST be 229 hexadecimally coded and that all appropriate fields for the "init- 230 word" response MUST be six-word coded. 232 Examples of these responses are: 234 init:f6bd 6b33 89b8 7203:md5 499 ke6118:23d1 b253 5ae0 2b7e 235 init:c9b2 12bb 6425 5a0f:md5 499 ke0986:fd17 cef1 b4df 093e: 236 6e1e faa6 b7d1 a43f:4c72 33b7 101a 7e62 238 init-word:MOOD SOFT POP COMB BOLO LIFE:md5 499 ke1235: 239 ARTY WEAR TAD RUG HALO GIVE 240 init-word:END KERN BALM NICK EROS WAVY:md5 499 ke1235: 241 BABY FAIN OILY NIL TIDY DADE:DIG DIVE SUNG HORN SWAG GAP: 242 GUT RODE CAKE ROY DATA GOER 244 (Note that all of these responses are one line. Due to their length, 245 they had to be split into multiple lines in order to be included 246 here. These responses MUST NOT span more than one line in actual 247 use) 249 Description of Fields 251 The old-OTP field contains a hexadecimally coded response to the OTP 252 challenge. The new-params field contains the parameters for the 253 client's new requested challenge and the new-OTP field contains a 254 hexadecimally coded response to that challenge. If the re- 255 initialization is successful, a server MUST store the new OTP in its 256 database as the last successful OTP received and the sequence number 257 in the next challenge presented by the server MUST be one less than 258 the sequence number specified in the new-params field. 260 The check-update and check-value fields provide a simple defense 261 against active attacks. This is not intended to provide a high level 262 of security. It is intended to make it significantly more difficult 263 for an active attacker to interfere with the OTP re-initialization 264 process and thus set the OTP sequence and/or secret pass phrase to a 265 value chosen by the attacker. The check fields are optional. They 266 require that a server store data that is secret for purposes of the 267 re-initialization. This is unacceptable in some circumstances. Also, 268 some sites may already employ other security solutions that already 269 eliminate active attacks (e.g., IP Security [RFC1825]). 271 These fields use a "check key" that is derived from a seed and the 272 secret pass phrase. The OTP system prepares them for iteration by 273 concatenating them and running them through a hash function. The 274 check key is generated the same way, except that the order of the 275 secret pass phrase and seed is reversed. If the secret pass phrase 276 and seed are the same, the hash result could be used to generate OTP 277 responses. Therefore, servers and generators MUST specifically 278 disallow the secret pass phrase to be the same as the seed. For re- 279 initialization methods that only supply the server with an OTP 280 result, this can be accomplished by generating an OTP using the same 281 sequence number and seed as the generator used and setting the 282 secret pass phrase equal to the seed. If the resulting OTP is the 283 same as the OTP supplied by the generator, then the server MUST 284 reject it. For re-initialization on the console or with another 285 secure channel that allows the user to supply the server with the 286 secret pass phrase as cleartext, this check can be made by a simple 287 string comparison. 289 The check-update field contains the exclusive-OR (XOR) of the check 290 key generated from the current seed and secret pass phrase with the 291 check key generated from the new seed and secret pass phrase. This 292 allows any party that knows the current check key -- which is 293 considered secret data -- to derive the new check key. 295 The check-value field contains the result of a standard envelope 296 message authentication code using the OTP folded hash function. 297 This is the result of running the folded hash function over the 298 concatenation of: 300 1. current check key 301 2. current-OTP 302 3. new-params (string) 303 4. new-OTP 304 5. check-update 305 6. current check key 307 The new-params field is hashed as a string the same way that a seed 308 or secret pass phrase would be. All other field values are hashed in 309 their uncoded binary forms, in network byte order and without any 310 padding. 312 Requirements 314 A server compliant with this specification: 316 1. MAY refuse to accept any init responses that do not carry the 317 active attack protection values 318 2. MAY refuse to accept any init responses for a user if it does not 319 have a check value in its database 320 3. MUST remove the init response check value from its database if 321 the secret pass phrase or seed change using any mechanism that does not 322 implement check values exactly the same way as the init 323 response 324 4. MUST NOT allow a user to use the same value for their seed and 325 secret pass phrase 326 5. MUST make the above check for all (re-)initialization methods 327 they support 328 6. MUST disable all OTP access to any principal whose sequence 329 number would be less than one 330 7. MUST handle the case where the old-OTP is valid but the active 331 attack protection check fails by acting as if the old-OTP 332 were provided as a standard response. That is, the next 333 challenge will contain the current seed and one less than the 334 current sequence number. 335 8. SHOULD allow a user to use the simple active attack protection 336 provided by the check-update and check-value fields 337 9. SHOULD require that this protection be used if it has a check 338 value in its database for the current secret pass phrase and seed 339 10. MUST perform the verification steps for the active attack 340 protection if it has a check value in its database for the old 341 secret pass phrase and seed and active attack protection information is 342 provided in the response 343 11. MUST NOT re-initialize the sequence if (10) fails, even if the 344 use of active attack protection is not mandatory 346 A generator compliant with this specification: 348 1. MUST NOT allow a user to use the same value for their seed and 349 secret pass phrase 350 2. MUST take specific steps to prevent infinite loops of 351 re-initialization attempts in case of failure 352 3. SHOULD provide the user with some indication that the 353 re-initialization is taking place 354 4. SHOULD support the simple active attack protection 355 5. SHOULD NOT do a re-initialization without the user's permission, 356 either for that specific instance or as a configuration option 358 6. SHOULD NOT retry a failed re-initialization without a user's 359 permission 360 7. MUST refuse to generate OTPs with a sequence number below one 362 6.0 SECURITY CONSIDERATIONS 364 All of the security considerations for the OTP system also apply to 365 the OTP system with extended responses. 367 The re-initialization response provides a means of protection 368 against active attacks. It is not meant to defeat well-funded and 369 well-skilled adversaries. This protection is not a substitute for 370 stronger measures such as IP Security. 372 The active attack protection requires that shared secret information 373 be stored on the server. It is the responsibility of the server to 374 keep that information secret. Disclosure of the secret data reduces 375 the security of the re-initialization response with active attack 376 protection to that of the response without it (the user's secret 377 pass phrase is not compromised, but an attacker could substitute a 378 different secret pass phrase). 380 7.0 ACKNOWLEDGEMENTS 382 Like rfc 1938, the protocol described in this document was created 383 by contributors in the IETF OTP working group. Specific 384 contributions were made by Neil Haller, who provided input on the 385 overall design requirements of a re-initialization protocol, Denis 386 Pinkas, who suggested an active attack defense mechanism that is 387 used here with minor modifications, and Phil Servita, who opened the 388 debate with the first real protocol proposal and provided lots of 389 specific input on the design of this and earlier protocols. 391 Randall Atkinson and Ted T'so also contributed their views to 392 discussions about details of the protocol extensions in this 393 document. 395 8.0 REFERENCES 397 [RFC 822] David H. Crocker, Standard for the Format of ARPA 398 Internet Text Messages, "Request for Comments (RFC) 399 822", August 13, 1982. 401 [RFC 1825] R. Atkinson, Security Architecture for the Internet 402 Protocol, "Request for Comments (RFC) 1825", August 9, 403 1995. 405 [RFC1938] N. Haller and C. Metz, A One-Time Password System, 406 "Request for Comments (RFC) 1938", Bellcore and Kaman 407 Sciences Corporation, May 1996. 409 9.0 Author's Address 411 Craig Metz 412 Kaman Sciences Corporation 413 For NRL Code 5544 414 4555 Overlook Avenue, S.W. 415 Washington, DC, 20375-5337, USA 417 Email: cmetz@itd.nrl.navy.mil 418 Appendix - Reference Responses 420 The following responses were generated by the One-Time Passwords in 421 Everything (OPIE) 2.3 implementation of the extended responses 422 described here. 424 All of these are responses to the challenge: 426 otp-md5 499 ke1234 428 Note that the re-initialization responses use the same secret pass 429 phrase for new and current and a new seed of "ke1235". Also, these 430 responses have been split for formatting purposes into multiple lines; 431 they MUST NOT be multiple lines in actual use. 433 The secret pass phrase for these responses is: 435 This is a test. 437 The OTP standard hexadecimal response is: 439 5bf0 75d9 959d 036d 441 The OTP standard six-word response is: 443 BOND FOGY DRAB NE RISE MART 445 The OTP extended "hex" response is: 447 hex:5bf0 75d9 959d 036f 449 The OTP extended "word" response is: 451 word:BOND FOGY DRAB NE RISE MART 453 The OTP extended "init" response without active attack protection is: 455 init:5BF0 75D9 959D 036F:md5 499 ke1235:3712 DCB4 AA53 16C1 457 The OTP extended "init-word" response without active attack protection 458 is: 460 init-word:BOND FOGY DRAB NE RISE MART:md5 499 ke1235: 461 RED HERD NOW BEAN PA BURG 463 The OTP extended "init" response with active attack protection is: 465 init:5BF0 75D9 959D 036F:md5 499 ke1235:3712 DCB4 AA53 16C1: 466 6E00 18AF 5582 73DE:E69E 1812 2A85 9DB6 468 The OTP extended "init-word" response with active attack protection 469 is: 471 init-word:BOND FOGY DRAB NE RISE MART:md5 499 ke1235: 472 RED HERD NOW BEAN PA BURG:CURL ADD NIB LATE MAO TRAY: 473 SWUM TUFT AVE BEAU BLUE SICK