Subject: Last Call: Telnet Authentication Option to Proposed Standard

From: "Othon Kamariotis" <[email-masked]>
Date: Tue, 23 Nov 1999 16:58:14 -0000

>It is safer to use 3-DES than single Des because we use a 128-bit key
>instead of a 64-bit key, so the number of possible keys is much bigger.
Also
>it has been reported that a method called 'match in the middle' could
>penetrate the single -DES but not the 3-DES.
>
>-----Original Message-----
>From: Jeffrey Altman <[email-masked]>
>To: Johan Danielsson <[email-masked]>
>Cc: [email-masked] <[email-masked]>;
>[email-masked] <[email-masked]>
>Date: Tuesday, November 23, 1999 4:24 PM
>Subject: Re: Last Call: Telnet Authentication Option to Proposed Standard
>
>
>>> Jeffrey Altman <[email-masked]> writes:
>>>
>>> > You are questioning the use of Triple DES but not the use of
>>> > CAST-128.
>>>
>>> I'm questioning the use of DES3 in anything but EDE on outer CBC
>>> mode. There is a paper by Eli Biham about other combinations, which
>>> basically says that most of them are not much better than single DES.
>>>
>>> Even though this paper doesn't talk about this specific use, it's not
>>> obvious that it's more secure to use DES3 to generate random numbers
>>> than it is to use single DES.
>>>
>>> Has this case been analysed by anyone?
>>>
>>> /Johan
>>>
>>
>>Thanks for explaining.  The answer is that I don't know.  I am not
>>qualified to make that analysis.
>>
>>
>>    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
>>                 The Kermit Project * Columbia University
>>              612 West 115th St #716 * New York, NY * 10025
>>  http://www.kermit-project.org/k95.html *
>[email-masked]
>>
>>
>>
>

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 23 Nov 99 17:35:39 EST

> Protocols that offer increased complexity but no gain in security or 
> efficiency over other standards-track efforts, but are in use today, are 
> IMHO excellent candidates for Informational publication.
> 
> Not for the standards track.

I think the point of this debate is whether or not there is added
strength to the encryption.  And so far the opinions have been
divergent.  If 3DES is a better PRNG than DES then it is stronger.

As we point out in the Drafts, the telnet encryption stream mechanism
is susceptible to attacks.  We know that.  We have addressed it in 
various ways.  Unfortunately, the Telnet AUTH option implementations
for Kerberos 4, Kerberos 5, and Secure Remote Password all rely on the
Telnet Encryption option for privacy.  I don't think it is appropriate
to send Telnet Auth to Proposed Standard with its reliance on an
option that is Informational.  Hence, the desire for all of these
drafts to go to Proposed Standard.

The TN3270 WG is working on a Telnet over TLS draft which has seen
several independent interoperable implementations for TN3270 and well
as more traditional telnet.  My hope is to integrate Telnet over TLS
with Telnet AUTH so that Telnet AUTH may be used to provide mutual
authentication via a TLS using an ADH cipher.  The one problem I have
run into is that the TLS Library vendors (other than OpenSSL) have
been very resistent to exporting the contents of the Finished messages
to the application so that they may be used in the Telnet Auth
negotiation to provide mutual authentication of the TLS.  Once this
draft goes to Proposed Standard I would recommend that the Telnet
Encryption option be moved to Historical.  But until that happens we
need it on the standards track.  

These drafts have been floating around the net for almost eight years
with many implementations.  Its time for them to move on.

- Jeff

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]