idnits 2.17.1 draft-nystrom-securid-sasl-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** The document seems to lack a 1id_guidelines paragraph about Internet-Drafts being working documents -- however, there's a paragraph with a matching beginning. Boilerplate error? == There is 1 instance of lines with non-ascii characters in the document. == It seems as if not all pages are separated by form feeds - found 0 form feeds but 11 pages Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. ** The abstract seems to contain references ([RFC2119], [RFC2222]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords -- however, there's a paragraph with a matching beginning. Boilerplate error? (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (December 1999) is 8893 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- ** Obsolete normative reference: RFC 1734 (Obsoleted by RFC 5034) ** Obsolete normative reference: RFC 2060 (Obsoleted by RFC 3501) ** Obsolete normative reference: RFC 2222 (Obsoleted by RFC 4422, RFC 4752) ** Obsolete normative reference: RFC 2234 (Obsoleted by RFC 4234) ** Obsolete normative reference: RFC 2251 (Obsoleted by RFC 4510, RFC 4511, RFC 4512, RFC 4513) ** Obsolete normative reference: RFC 2279 (Obsoleted by RFC 3629) Summary: 10 errors (**), 0 flaws (~~), 4 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 1 INTERNET-DRAFT M. Nystrom 2 Expires: May 2000 RSA Laboratories 3 Intended Category: Informational December 1999 5 The SecurID(r) SASL Mechanism 7 9 Status of this Memo 11 This document is an Internet-Draft and is in full conformance with 12 all provisions of Section 10 of [RFC2026]. 14 Internet-Drafts are working documents of the Internet Engineering 15 Task Force (IETF), its areas, and its working groups. Note that 16 other groups and individuals may also distribute working documents as 17 Internet-Drafts. 19 Internet-Drafts are draft documents valid for a maximum of six months 20 and may be updated, replaced, or obsoleted by other documents at any 21 time. It is inappropriate to use Internet-Drafts as reference 22 material or to cite them other than as "work in progress." 24 The list of current Internet-Drafts can be accessed at 25 http://www.ietf.org/ietf/1id-abstracts.txt. 27 The list of Internet-Draft Shadow Directories can be accessed at 28 http://www.ietf.org/shadow.html. 30 This Internet-Draft expires in June, 2000. Comments and suggestions 31 on this document are encouraged. Comments on this document should be 32 sent directly to the author. 34 Abstract 36 SecurID is a hardware token card product (or software emulation 37 thereof) produced by RSA Security, Inc., which is used for end-user 38 authentication. This document defines a SASL [RFC2222] authentication 39 mechanism using these tokens, thereby providing a means for such 40 tokens to be used in SASL environments. This mechanism is only for 41 authentication, and has no effect on the protocol encoding and is not 42 designed to provide integrity or confidentiality services. 44 This memo assumes the reader has basic familiarity with the SecurID 45 token, its associated authentication protocol and SASL. 47 How to read this document 49 The key words "MUST", "MUST NOT", "SHALL", "SHOULD" and "MAY" in this 50 document are to be interpreted as defined in [RFC2119]. 52 In examples, "C:" and "S:" indicate messages sent by the client and 53 server respectively. 55 1. Introduction 57 The SECURID SASL mechanism is a good choice for usage scenarios where 58 a client, acting on behalf of a user, is untrusted, as a one-time 59 passcode will only give the client a single opportunity to act 60 maliciously. This mechanism provides authentication only. 62 The SECURID SASL mechanism provides a formal way to integrate the 63 existing SecurID authentication method into SASL-enabled protocols 64 including IMAP [RFC2060], ACAP [RFC2244], POP3 [RFC1734] and LDAPv3 65 [RFC2251]. 67 2. Authentication Model 69 The SECURID SASL mechanism provides two-factor based user 70 authentication as defined below. 72 There are basically three entities in the authentication mechanism 73 described here: A user, possessing a SecurID token, an application 74 server, to which the user wants to connect, and an authentication 75 server, capable of authenticating the user. Even though the 76 application server in practice may function as a client with respect 77 to the authentication server, relaying authentication credentials 78 etc. as needed, both servers are, unless explicitly mentioned, 79 collectively termed "the server" here. The protocol used between the 80 application server and the authentication server is outside the scope 81 of this memo. The application client, acting on behalf of the user, 82 is termed "the client". 84 The mechanism is based on the use of a shared secret key, or "seed", 85 and a personal identification number (PIN), which is known both by 86 the user and the authentication server. The secret seed is stored on 87 a token that the user possesses, as well as on the authentication 88 server. Hence the term "two-factor authentication", a user needs not 89 only physical access to the token but also knowledge about the PIN in 90 order to perform an authentication. Given the seed, current time of 91 day, and the PIN, a "PASSCODE(r)" is generated by the user's token 92 and sent to the server. 94 The SECURID SASL mechanism provides one service: 96 - User authentication where the user provides information to 97 the server, so that the server can authenticate the user. 99 This mechanism is identified with the SASL key "SECURID". 101 3. Authentication Procedure 103 a) The client generates the credentials using local information 104 (seed, current time and user PIN/password). 106 b) If the underlying protocol permits, the client sends credentials 107 to the server in an initial response message. Otherwise, the 108 client sends a request to the server to initiate the 109 authentication mechanism, and sends credentials after the server's 110 response (see [RFC2222] section 5.1 for more information regarding 111 the initial response option). 113 Unless the server requests a new PIN (see below), the contents of 114 the client's initial response SHALL be as follows: 116 (1) An authorization identity. When this field is empty, it 117 defaults to the authentication identity. This field MAY be 118 used by system administrators or proxy servers to login with a 119 different user identity. This field MUST NOT be longer than 255 120 octets, SHALL be terminated by a NUL (0) octet, and MUST 121 consist of UTF-8-encoded [RFC2279] printable characters only 122 (US-ASCII [X3.4] is a subset of UTF-8). 124 (2) An authentication identity. The identity whose passcode 125 will be used. If this field is empty, it is assumed to have 126 been transferred by other means (e.g. if the underlying protocol 127 has support for this, like [RFC2251]). This field MUST NOT be 128 longer than 255 octets, SHALL be terminated by a NUL (0) octet, 129 and MUST consist of UTF-8-encoded printable characters only. 131 (3) A passcode. The one-time password that will be used to grant 132 access. This field MUST NOT be shorter than 4 octets, MUST NOT be 133 longer than 32 octets, SHALL be terminated by a NUL (0) octet, 134 and MUST consist of UTF-8-encoded printable characters only. 135 Passcodes usually consist of 4-8 digits. 137 The ABNF [RFC2234] form of this message is as follows: 139 credential-pdu = authorization-id authentication-id passcode [pin] 141 authorization-id = 0*255VUTF8 %x00 143 authentication-id = 0*255VUTF8 %x00 145 passcode = 4*32VUTF8 %x00 147 pin ::= 4*32VUTF8 %x00 149 VUTF8 = 151 Regarding the rule, see d) below. 153 c) The server verifies these credentials using its own information. 154 If the verification succeeds, the server sends back a 155 response indicating success to the client. After receiving this 156 response, the client is authenticated. Otherwise, the verification 157 either failed or the server needs an additional set of credentials 158 from the client in order to authenticate the user. 160 d) If the server needs an additional set of credentials, it requests 161 them now. This request has the following format, described in ABNF 162 notation: 164 server-request = passcode | pin 166 passcode = "passcode" %x00 168 pin = "pin" %x00 [suggested-pin] 170 suggested-pin = 4*32VUTF8 %x00 ; Between 4 and 32 UTF-8 characters 172 The 'passcode' choice will be sent when the server requests 173 another passcode. The 'pin' choice will be sent when the server 174 requests a new user PIN. The server will either send an empty 175 string or suggest a new user PIN in this message. 177 e) The client generates a new set of credentials using local 178 information and depending on the server's request and sends them 179 to the server. Authentication now continues as in c) above. 181 Note 1: Case d) above may occur e.g. when the clocks on which the 182 server and the client relies are not synchronized. 184 Note 2: If the server requests a new user PIN, the client MUST 185 respond with a new user PIN (together with a passcode), encoded as a 186 UTF-8 string. If the server supplies the client with a suggested PIN, 187 the client accepts this by replying with the same PIN, but MAY 188 replace it with another one. The length of the PIN is application- 189 dependent as are any other requirements for the PIN, e.g. allowed 190 characters. If the server for some reason does not accept the 191 received PIN, the client MUST be prepared to receive either a message 192 indicating the failure of the authentication or a repeated request 193 for a new PIN. Mechanisms for transferring knowledge about PIN 194 requirements from the server to the client are outside the scope of 195 this memo. However, some information MAY be provided in error 196 messages transferred from the server to the client when applicable. 198 4. Examples 200 4.1 IMAP4 202 The following example shows the use of the SECURID SASL mechanism 203 with IMAP4. The example is only designed to illustrate the protocol 204 interaction but do provide valid encoding examples. 206 The base64 encoding of the last client response, as well as the "+ " 207 preceding the response, is part of the IMAP4 profile, and not a part 208 of this specification itself. 210 S: * OK IMAP4 server ready 211 C: A001 CAPABILITY 212 S: * CAPABILITY IMAP4 AUTH=CRAM-MD5 AUTH=SECURID 213 S: A001 OK done 214 C: A002 AUTHENTICATE SECURID 215 S: + 216 C: AG1hZ251cwAxMjM0NTY3OAA= 217 S: A002 OK Welcome, SECURID authenticated user: magnus 219 4.2 LDAPv3 221 The following examples show the use of the SECURID SASL mechanism 222 with LDAPv3. The examples are only designed to illustrate the 223 protocol interaction, but do provide valid encoding examples. 224 Usernames, passcodes and PINs are of course fictitious. For 225 readability, all messages are shown in the value-notation defined in 226 [X680]. values are shown hex-encoded in the 227 'credentials' field of LDAP's 'BindRequest' and 228 values are shown hex-encoded in the 'serverSaslCreds' field of LDAP's 229 'BindResponse'. 231 4.2.1 LDAPv3 Example 1 233 Initial response message, successful authentication. 235 C: { messageID 1, 236 protocolOp bindRequest : 237 { version 1, 238 name '434E3D4D41474E5553'H, -- "CN=MAGNUS" 239 authentication sasl : 240 { mechanism '53454355524944'H, -- "SECURID" 241 credentials '006d61676e757300313233343536373800'H 242 } 243 } 244 } 246 S: { messageID 1, 247 protocolOp bindResponse : 248 { resultCode success, 249 matchedDN ''H, 250 errorMessage ''H, 251 } 252 } 254 4.2.2 LDAPv3 Example 2 256 Initial response message, server requires second passcode. 258 C: { 259 messageID 1, 260 protocolOp bindRequest : { 261 version 1, 262 name '434E3D4D41474E5553'H, -- "CN=MAGNUS" 263 authentication sasl : { 264 mechanism '53454355524944'H, -- "SECURID" 265 credentials '006d61676e757300313233343536373800'H 266 } 267 } 268 } 270 S: { 271 messageID 1, 272 protocolOp bindResponse : { 273 resultCode saslBindInProgress, 274 matchedDN ''H, 275 errorMessage ''H, 276 serverSaslCreds '70617373636f646500'H 277 } 278 } 279 C: { 280 messageID 1, 281 protocolOp bindRequest : { 282 version 1, 283 name '434E3D4D41474E5553'H, -- "CN=MAGNUS" 284 authentication sasl : { 285 mechanism '53454355524944'H, -- "SECURID" 286 credentials '006d61676e757300383736353433323100'H 287 } 288 } 289 } 291 S: { 292 messageID 1, 293 protocolOp bindResponse : { 294 resultCode success, 295 matchedDN ''H, 296 errorMessage ''H, 297 } 298 } 300 4.2.3 LDAPv3 Example 3 302 Initial response message, server requires new PIN and passcode, and 303 supplies client with a suggested new PIN (which the client accepts). 305 C: { 306 messageID 1, 307 protocolOp bindRequest : { 308 version 1, 309 name '434E3D4D41474E5553'H, -- "CN=MAGNUS" 310 authentication sasl : { 311 mechanism '53454355524944'H, -- "SECURID" 312 credentials '006d61676e757300313233343536373800'H 313 } 314 } 315 } 317 S: { 318 messageID 1, 319 protocolOp bindResponse : { 320 resultCode saslBindInProgress, 321 matchedDN ''H, 322 errorMessage ''H, 323 serverSaslCreds '70696e006b616c6c6500'H 324 } 325 } 326 C: { 327 messageID 1, 328 protocolOp bindRequest : { 329 version 1, 330 name '434E3D4D41474E5553'H, -- "CN=MAGNUS" 331 authentication sasl : { 332 mechanism '53454355524944'H, -- "SECURID" 333 credentials '006d61676e7573003837343434363734006b616c6c6500'H 334 } 335 } 336 } 338 S: { 339 messageID 1, 340 protocolOp bindResponse : { 341 resultCode success, 342 matchedDN ''H, 343 errorMessage ''H, 344 } 345 } 347 5. Security Considerations 349 This mechanism only provides protection against passive eavesdropping 350 attacks. It does not provide session privacy, server authentication 351 or protection from active attacks. In particular, man-in-the-middle 352 attacks, were an attacker acts as an application server in order to 353 acquire a valid passcode are possible. 355 In order to protect against such attacks, the client SHOULD make sure 356 that the server is properly authenticated. When user PINs are 357 transmitted, user authentication SHOULD take place on a server- 358 authenticated and confidentiality-protected connection. 360 Server implementations MUST protect against replay attacks, since an 361 attacker could otherwise gain access by replaying a previous, valid 362 request. Clients MUST also protect against replay of PIN-change 363 messages. 365 5.1 The Race Attack 367 It is possible for an attacker to listen to most of a passcode, guess 368 the remainder, and then race the legitimate user to complete the 369 authentication. As for OTP [RFC2289], conforming server 370 implementations MUST protect against this race condition. One defense 371 against this attack is outlined below and borrowed from [RFC2289]; 372 implementations MAY use this approach or MAY select an alternative 373 defense. 375 One possible defense is to prevent a user from starting multiple 376 simultaneous authentication sessions. This means that once the 377 legitimate user has initiated authentication, an attacker would be 378 blocked until the first authentication process has completed. In 379 this approach, a timeout is necessary to thwart a denial of service 380 attack. 382 6. IANA Considerations 384 By registering the SecurID protocol as a SASL mechanism, implementers 385 will have a well-defined way of adding this authentication mechanism 386 to their product. Here is the registration template for the SECURID 387 SASL mechanism: 389 SASL mechanism name: SECURID 390 Security Considerations: See corresponding section of this memo 391 Published specification: This memo 392 Person & email address to 393 contact for further 394 information: See author's address section below 395 Intended usage: COMMON 396 Author/Change controller: See author's address section below 398 7. Intellectual Property Considerations 400 RSA Security Inc. does not make any claims on the general 401 constructions described in this memo, although underlying techniques 402 may be covered. Among the underlying techniques, the SecurID 403 technology is covered by a number of US patents (and foreign 404 counterparts), in particular US patent no. 4,885,778, no. 5,097,505, 405 no. 5,168,520, and 5,657,388. 407 SecurID is a registered trademark, and PASSCODE is a trademark, of 408 RSA Security Inc. 410 8. Copyright 412 Copyright (C) The Internet Society (1999). All Rights Reserved. 414 This document and translations of it may be copied and furnished to 415 others, and derivative works that comment on or otherwise explain it 416 or assist in its implementation may be prepared, copied, published 417 and distributed, in whole or in part, without restriction of any 418 kind, provided that the above copyright notice and this paragraph are 419 included on all such copies and derivative works. However, this 420 document itself may not be modified in any way, such as by removing 421 the copyright notice or references to the Internet Society or other 422 Internet organizations, except as needed for the purpose of 423 developing Internet standards in which case the procedures for 424 copyrights defined in the Internet Standards process must be 425 followed, or as required to translate it into languages other than 426 English. 428 The limited permissions granted above are perpetual and will not be 429 revoked by the Internet Society or its successors or assigns. 431 This document and the information contained herein is provided on an 432 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 433 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 434 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 435 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 436 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 438 9. References 440 [RFC1734] Myers, J., "POP3 AUTHentication command," IETF RFC 1734, 441 December 1994. 443 [RFC2026] Bradner, S., "The Internet Standards Process -- Revision 444 3," IETF RFC 2026, October 1996. 446 [RFC2060] Crispin, M., "Internet Message Access Protocol - Version 447 4rev1," IETF RFC 2060, December 1996. 449 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 450 Requirement Levels," IETF RFC 2119, March 1997. 452 [RFC2222] Myers, J., "Simple Authentication and Security Layer," IETF 453 RFC 2222, October 1997. 455 [RFC2234] Crocker, D., Overell, P., "Augmented BNF for Syntax 456 Specifications: ABNF", IETF RFC 2234, November 1997. 458 [RFC2244] Newman, C., Myers J., "RFC2244 -- Application Configuration 459 Access Protocol," IETF RFC 2244, November 1997. 461 [RFC2251] Wahl, M., Howes, T., Kille, S., "Lightweight Directory 462 Access Protocol (v3)," IETF RFC 2251, December 1997. 464 [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 10646," 465 IETF RFC 2279, January 1998. 467 [RFC2289] Haller, N., Metz, C., Nesser, P., Straw, M., "A One-Time 468 Password System," IETF RFC 2289, February 1998. 470 [X3.4] ANSI, "ANSI X3.4: Information Systems - Coded Character Sets - 471 7-Bit American National Standard Code for Information Interchange 472 (7-Bit ASCII)," American National Standards Institute. 474 [X680] ITU-T, "Information Technology - Abstract Syntax Notation One 475 (ASN.1): Specification of Basic Notation," International 476 Telecommunication Union, 1997. 478 10. Acknowledgements 480 The author gratefully acknowledge the contributions of various 481 reviewers of this memo, in particular the ones from John Myers. They 482 have significantly clarified and improved the utility of this 483 specification. 485 11. Author's Address 487 Magnus Nystr�m 488 RSA Laboratories 489 Box 10704 490 121 29 Stockholm 491 Sweden 493 Phone: +46 8 725 0900 494 Email: magnus@rsasecurity.com