rfc2808.txt

来自「RFC 的详细文档！」· 文本 代码 · 共 620 行 · 第 1/2 页

   S:  {
       messageID 1,
       protocolOp bindResponse : {
           resultCode saslBindInProgress,
           matchedDN  ''H,
           errorMessage ''H,
           serverSaslCreds '70617373636f646500'H
       }
   }

   C:  {
       messageID 1,
       protocolOp bindRequest : {
           version 1,
           name '434E3D4D41474E5553'H, -- "CN=MAGNUS"
           authentication sasl : {
               mechanism '53454355524944'H, -- "SECURID"
               credentials '006d61676e757300383736353433323100'H
           }
       }
   }

   S:  {
       messageID 1,



Nystrom                      Informational                      [Page 6]

RFC 2808             The SecurID(r) SASL Mechanism            April 2000


       protocolOp bindResponse : {
           resultCode success,
           matchedDN  ''H,
           errorMessage ''H,
       }
   }

4.2.3 LDAPv3 Example 3

   Initial response message, server requires new PIN and passcode, and
   supplies client with a suggested new PIN (which the client accepts).

   C:  {
       messageID 1,
       protocolOp bindRequest : {
           version 1,
           name '434E3D4D41474E5553'H, -- "CN=MAGNUS"
           authentication sasl : {
               mechanism '53454355524944'H, -- "SECURID"
               credentials '006d61676e757300313233343536373800'H
           }
       }
   }

   S:  {
       messageID 1,
       protocolOp bindResponse : {
           resultCode saslBindInProgress,
           matchedDN  ''H,
           errorMessage ''H,
           serverSaslCreds '70696e006b616c6c6500'H
       }
   }

   C:  {
       messageID 1,
       protocolOp bindRequest : {
           version 1,
           name '434E3D4D41474E5553'H, -- "CN=MAGNUS"
           authentication sasl : {
               mechanism '53454355524944'H, -- "SECURID"
           credentials '006d61676e7573003837343434363734006b616c6c6500'H
           }
       }
   }

   S:  {
       messageID 1,



Nystrom                      Informational                      [Page 7]

RFC 2808             The SecurID(r) SASL Mechanism            April 2000


       protocolOp bindResponse : {
           resultCode success,
           matchedDN  ''H,
           errorMessage ''H,
       }
   }

5. Security Considerations

   This mechanism only provides protection against passive eavesdropping
   attacks. It does not provide session privacy, server authentication
   or protection from active attacks. In particular, man-in-the-middle
   attacks, were an attacker acts as an application server in order to
   acquire a valid passcode are possible.

   In order to protect against such attacks, the client SHOULD make sure
   that the server is properly authenticated. When user PINs are
   transmitted, user authentication SHOULD take place on a server-
   authenticated and confidentiality-protected connection.

   Server implementations MUST protect against replay attacks, since an
   attacker could otherwise gain access by replaying a previous, valid
   request. Clients MUST also protect against replay of PIN-change
   messages.

5.1 The Race Attack

   It is possible for an attacker to listen to most of a passcode, guess
   the remainder, and then race the legitimate user to complete the
   authentication. As for OTP [RFC2289], conforming server
   implementations MUST protect against this race condition. One defense
   against this attack is outlined below and borrowed from [RFC2289];
   implementations MAY use this approach or MAY select an alternative
   defense.

   One possible defense is to prevent a user from starting multiple
   simultaneous authentication sessions. This means that once the
   legitimate user has initiated authentication, an attacker would be
   blocked until the first authentication process has completed.  In
   this approach, a timeout is necessary to thwart a denial of service
   attack.

6. IANA Considerations

   By registering the SecurID protocol as a SASL mechanism, implementers
   will have a well-defined way of adding this authentication mechanism
   to their product. Here is the registration template for the SECURID
   SASL mechanism:



Nystrom                      Informational                      [Page 8]

RFC 2808             The SecurID(r) SASL Mechanism            April 2000


      SASL mechanism name:      SECURID
      Security Considerations:  See corresponding section of this memo
      Published specification:  This memo
      Person & email address to
      contact for further
      information:              See author's address section below
      Intended usage:           COMMON
      Author/Change controller: See author's address section below

7. Intellectual Property Considerations

   RSA Security Inc. does not make any claims on the general
   constructions described in this memo, although underlying techniques
   may be covered. Among the underlying techniques, the SecurID
   technology is covered by a number of US patents (and foreign
   counterparts), in particular US patent no. 4,885,778, no. 5,097,505,
   no. 5,168,520, and 5,657,388.

   SecurID is a registered trademark, and PASSCODE is a trademark, of
   RSA Security Inc.

8. References

   [RFC1734] Myers, J., "POP3 AUTHentication command", RFC 1734,
             December 1994.

   [RFC2026] Bradner, S., "The Internet Standards Process -- Revision
             3", BCP 9, RFC 2026, October 1996.

   [RFC2060] Crispin, M., "Internet Message Access Protocol - Version
             4rev1", RFC 2060, December 1996.

   [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC2222] Myers, J., "Simple Authentication and Security Layer", RFC
             2222, October 1997.

   [RFC2234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
             Specifications: ABNF", RFC 2234, November 1997.

   [RFC2244] Newman, C. and J. Myers, "ACAP -- Application Configuration
             Access Protocol", RFC 2244, November 1997.

   [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
             Access Protocol (v3)", RFC 2251, December 1997.





Nystrom                      Informational                      [Page 9]

RFC 2808             The SecurID(r) SASL Mechanism            April 2000


   [RFC2279] Yergeau, F., "UTF-8, a transformation format of ISO 10646",
             RFC 2279, January 1998.

   [RFC2289] Haller, N., Metz, C., Nesser, P. and M. Straw, "A One-Time
             Password System", RFC 2289, February 1998.

   [X3.4]    ANSI, "ANSI X3.4: Information Systems - Coded Character
             Sets - 7-Bit American National Standard Code for
             Information Interchange (7-Bit ASCII)," American National
             Standards Institute.

   [X680]    ITU-T, "Information Technology - Abstract Syntax Notation
             One (ASN.1): Specification of Basic Notation,"
             International Telecommunication Union, 1997.

9. Acknowledgements

   The author gratefully acknowledges the contributions of various
   reviewers of this memo, in particular the ones from John Myers.  They
   have significantly clarified and improved the utility of this
   specification.

10. Author's Address

   Magnus Nystrom
   RSA Laboratories
   Box 10704
   121 29 Stockholm
   Sweden

   Phone: [phone]
   EMail: [e-mail]



















Nystrom                      Informational                     [Page 10]

RFC 2808             The SecurID(r) SASL Mechanism            April 2000


11.  Full Copyright Statement

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Nystrom                      Informational                     [Page 11]