rapidfx: переводы

→Let q>2^160 and p>2^1024 be primes such that p=rq+1 with r not a multiple of q. Take h���Zp* such that g==h^r is not 1. These parameters may be chosen by the NIST algorithm for DSA, and are public, fixed values. The client C knows a secret � and computes H==(H1(C, �))r and H^-1, where H1 is a hash function yielding a random element of Zp*, and H^-1 may be computed by gcd. (All arithmetic is modulo p.) The client gives H^-1 to the server S ahead of time by a private channel. To start a new connection, the client generates a random value x, computes m==g^xH, then calls the server and sends C and m. The server checks m!=0 mod p, generates random y, computes �==g^y, �==(mH^-1)y, and sends S, �, k==sha1("server",C,S,m,�,�,H-1). Next the client computes �=�x, verifies k, and sends k´==sha1("client",C,S,m,�,�,H^-1). The server then verifies k´ and both sides begin using session key K==sha1("session",C,S,m,�,�,H^-1). In the published version of PAK, the server name S is included in the initial hash H, but doing so is inconvenient in our application, as the server may be known by various equivalent names.

→Appendix: Summary of the PAK protocol

→[Ylon96] Ylonen, T., SSH--Secure Login Connections Over the Internet,'' 6th USENIX Security Symposium, pp. 37-42. San Jose, CA, July 1996.

→[Wu98] T. Wu, The Secure Remote Password Protocol,'' Proceedings of the 1998 Internet Society Network and Distributed System Security Symposium, San Diego, CA, March 1998, pp. 97-111.

→[Stei88] Jennifer G. Steiner, Clifford Neumann, and Jeffrey I. Schiller, Kerberos: An Authentication Service for Open Network Systems,'' Proceedings of USENIX Winter Conference, Dallas, Texas, February 1988, pp. 191­202.

→[Sama96] Vipin Samar, Unified Login with Pluggable Authentication Modules (PAM),'' Proceedings of the Third ACM Conference on Computer Communications and Security, March 1996, New Delhi, India.

→[Schn] Bruce Schneier, Password Safe, http://www.counterpane.com/passsafe.html.

→[RiLa] Ronald L. Rivest and Butler Lampson, SDSI--A Simple Distributed Security Infrastructure,'' http://theory.lcs.mit.edu/~rivest/sdsi10.ps.

→[RFC2138] C. Rigney, A. Rubens, W. Simpson, S. Willens, Remote Authentication Dial In User Service (RADIUS),'' RFC2138, April 1997.

→[Resc01] Eric Rescorla, SSL and TLS: Designing and Building Secure Systems,'' Addison-Wesley, 2001. ISBN 0-201-61598-3, p. 387.

→[Pike93] Rob Pike, Dave Presotto, Ken Thompson, Howard Trickey, Phil Winterbottom, The Use of Name Spaces in Plan 9,'' Operating Systems Review, 27, 2, April 1993, pp. 72-76 (reprinted from Proceedings of the 5th ACM SIGOPS European Workshop, Mont Saint-Michel, 1992, Paper nº 34).

→[Pike95] Rob Pike, Dave Presotto, Sean Dorward, Bob Flandrena, Ken Thompson, Howard Trickey, and Phil Winterbottom, Plan 9 from Bell Labs,'' Computing Systems, 8, 3, Summer 1995, pp. 221-254.

→[Perl99] Radia Perlman and Charlie Kaufman, Secure Password-Based Protocol for Downloading a Private Key,'' Proc. 1999 Network and Distributed System Security Symposium, Internet Society, January 1999.

→[Micr] Microsoft Passport, http://www.passport.com/.

→[Mazi99] David Mazières, Michael Kaminsky, M. Frans Kaashoek and Emmett Witchel, Separating key management from file system security,'' Symposium on Operating Systems Principles, 1999, pp. 124-139.

→[Mack] Philip MacKenzie, private communication.

→[Kami00] Michael Kaminsky. Flexible Key Management with SFS Agents,'' Master's Thesis, MIT, May 2000.

→[Jabl] David P. Jablon, Strong Password-Only Authenticated Key Exchange,'' http://integritysciences.com/speke97.html.

→[Ford00] Warwick Ford and Burton S. Kaliski, Jr., Server-Assisted Generation of a Strong Secret from a Password,'' IEEE Fifth International Workshop on Enterprise Security, National Institute of Standards and Technology (NIST), Gaithersburg MD, June 14 - 16, 2000.

→[RFC2246] T . Dierks and C. Allen, The TLS Protocol, Version 1.0,'' RFC 2246.