Thank you so much for your responses. By  "predetermined ", i meant the

challenges appear sequentially in decremented fashion, so are we aware of

any security hole with this. I ask this because usually the

challenge/response implementations consider generating random challenges( i

think here they have a weakness where the passphrase need to be in clear

text).
My problem is to determine the best challenge/response implementation for

authenticating the clients.
Please correct me if i missed something.
Thanks and Regards,

Ivan
On Tue, Jul 8, 2008 at 5:00 PM, Peter Jeremy

wrote:
> On 2008-Jul-08 15:46:37 +0530, Ivan Grover  wrote:

quoted text
> >Iam trying to choose OPIE as my OTP implementation for authenticating the

> >clients. I have the following queries, could anyone please let me know

> these

> >-- why does the challenge in OPIE are in predetermined form..

> >is it for determining the decryption key for the encrypted

> passphrase(stored

> >in opiekeys).

>

> The passphrase is not encrypted - it is hashed and cannot be "decrypted".

> Basically, the passphrase and seed are concatenated and the result is

> hashed (using MD5) the number of times specified by the iteration count

> and the seed, count and final hash are stored in /etc/opiekeys.

>

> The supplied response is easily verified because when you run it thru

> MD5, you should get the hash in /etc/opiekeys.  You then replace that

> hash with the one the user supplied.

>

> >-- is it possible to generate random challenges using opiechallenge

>

> No.  The seed has to match the seed that was used to generate the

> hash with opiepasswd.

>

> --

> Peter Jeremy

> Please excuse any delays as the result of my ISP's inability to implement

> an MTA that is either RFC2821-compliant or matches their claimed behaviour.

>

_______________________________________________

freebsd-security@freebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-security

To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"