MV3D Development Blog

So, pointed out some holes in my authentication scheme. Apparently authenticating two untrusted entities via a third trusted entity is tough. Also, PB doesn’t support what I was trying to do anyway. Here’s try #2:

A = Account server. This guy actually holds the account details like passwords
L = Login server. Could be the same as A
C = Client. The one who wants to make the connection. Could be a server really.
S = Server. The one who the connection is being made to.

1. C logs in to L
2. C calls L.createPasswords(unique id)
   1. L calls A.createPasswords(username, unique id) returns two random passwords, a login password and a server password. Both encrypted with a key that C knows. The passwords are attached (via the unique id) to username’s account.
3. C calls S.login(username + “:” + unique id, login password) this is over PB, so it’s challenge response, etc.
   1. P logs in to L
   2. P calls L.getPasswords(username, unique id)..
      1. L calls P.getPasswords(username, unique id) this returns the two passwords (encrypted with a key P knows).
   3. P checks the login password against what C gave it and grants access if it matches
4. C calls P.challenge(random data)
5. P returns a md5 digest of the challenge plus the server password
6. C verifies the server password against the one the login server gave it

Assumptions:

• Connection between L and A is secure.
• L and A are intended to both be servers run by me/MV3D.
• L and A are separate servers since L is a publicly accessible server, so it shouldn’t have account details on it.
• Communication between any server and L is under SSL.

Holes: If either C or P’s login user+password is compromised, they can be impersonated.

X Logs in to L

1. X calls L.challenge() which returns random data that is recorded in X’s session on L
2. X AES encrypts time, username using the md5 of the challenge and username’s password
3. X calls L.authenticateSession(username, AES encrypted data)
   1. L calls A.authenticateSession(username, the random data, the AES encrypted data)
   2. A validates the encrypted data and returns non confidential account info to L plus AES encrypted original time, A’s server name
4. L returns the encrypted data from authenticateSession back to X

Apologies if this makes no sense, or if it’s completely dumb. It’s late, and I should really be asleep and not trying to solve authentication problems.