 |
Professor von Clueless in the Blunder Dome |
status privacy about contact |
|
Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.
Atom Feed Associated Blogs 
Recent Items Archives |
Saturday, March 26, 2005Open Authentication: One-Time Passwords and Crypto-HashingACM News Service: SHA-1 Flaw Seen as No Risk to One-Time Password Proposal. I've seen several links to Mark Willoughby's 2005-03-22 Computerworld article and I passed over each one, thinking the title was self-explanatory and that I understood why SHA-1 is still usable based on Bruce Schneier's reporting on the topic. Fortunately, I did glance over this TechNews summary in my regular scanning of that source. Here's interesting material that you might have overlooked too, and that I want to examine as part of TROSTing development. The Initiative for Open Authentication (Oath!) has the vision of developing strong universal authentication: among all users, all devices, and all networks. The consortium is out to produce a reference architecture based on existing "open standards." (The term "leveraging" is used, so your credibility may vary.) Vision is vision, and some of this may end up being a solution looking to reword the problem, but the effort is interesting to me, especially because the authentication part is based on Hashed Message Authentication Codes (HMACs) and what are called one-time passwords. The scheme is based on SHA-1. There is a very weird statement that this use is less vulnerable to connived collisions because only a small selection of the 60-bit hash are used, and that claim left my jaw hanging open. There is more to the protocol than that, unless information theory has failed. And I remain interested because I want to know how this might work with persistent entities (some of the everythings that the vision is intended to embrace). The one-time password scheme is being proposed to the IETF and their is expected to be a standards-track adoption real-soon-now. The question will be, as always, how trust is established and recognized with all of these wondrous technical mechanisms in place, and how symmetrical can that trust arrangement be? We seem to forget that one can also connive an unreliable application atop a reliable protocol, and this may matter more. Comments: Post a Comment |
|
|
You are navigating the Blunder Dome |
template created 2004-06-17-20:01 -0700 (pdt)
by orcmid |