Le mar. 16 juin 2020 à 20:42, Henning Westerholt hw@skalatan.de a écrit :

Hello,

take a look to this parameter, you can switch between MD5 and SHA256, but only use once at a time:

https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorit...

About planned features – I am not aware of major extensions in this module. Of course, any contribution is welcome.

Thanks for your answer. If I have some time, I might try to make a PR on being able to select the algorithm at runtime.

Regards, Aymeric

Cheers,

Henning

--

Henning Westerholt – https://skalatan.de/blog/

Kamailio services – https://gilawa.com

*From:* sr-users sr-users-bounces@lists.kamailio.org *On Behalf Of *Aymeric Moizard *Sent:* Monday, June 15, 2020 10:31 PM *To:* Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org *Subject:* [SR-Users] MD5 and SHA-256 instead of MD5 or SHA-256...

Hi All,

I'd like to improve my setup by switching to SHA-256.

However, as a first step, I would like to offer both MD5 and SHA-256

in 2 different WWW-Authenticate header.

If I'm correct, this is not doable with the latest auth module?

Is this a planned feature?

As an alternative, I would like to decide the algorithm in the script

instead of a module parameter. It looks to me this is also not doable?

Again, is this a planned feature?

Thanks to all,

Regards

Aymeric

--

Antisip - http://www.antisip.com

Whoever works on this needs to consider two things I think:

- ability to select algorithms when challenging UAC (MD5-only, SHA256-only, SHA-512/256-only, all permutations). The RFC allows UAS to include multiple HFs(*). MD5-only should probably be the default. I suspect there might be a significantly non-trivial population of UACs that would get confused receiving multiple digests. Plus enabling challenges for all protocols would expand the size of 401s messages.

- ability to accept response in either of supported hashing methods or any combination of thereof. The reasonable default here is probably MD5-only for now, again to prevent the possibility of foul play when we only request MD5, while for some reason getting say SHA-256 back.

-Max

*) Example:

401 Unauthorized

[..] WWW-Authenticate: Digest realm="http-auth@example.org", qop="auth, auth-int", algorithm=SHA-256, nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS" WWW-Authenticate: Digest realm="http-auth@example.org", qop="auth, auth-int", algorithm=MD5, nonce="7ypf/xlj9XXwfDPEoM4URrv/xwf94BcCAzFZH4GiTo0v", opaque="FQhe/qaU925kfnzjCev0ciny7QMkPqMAFRtzCUYo5tdS"

On Tue., Jun. 16, 2020, 12:13 p.m. Aymeric Moizard, amoizard@gmail.com wrote:

Le mar. 16 juin 2020 à 20:42, Henning Westerholt hw@skalatan.de a écrit :

...

Hello,

take a look to this parameter, you can switch between MD5 and SHA256, but only use once at a time:

https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorit...

About planned features – I am not aware of major extensions in this module. Of course, any contribution is welcome.

Thanks for your answer. If I have some time, I might try to make a PR on being able to select the algorithm at runtime.

Regards, Aymeric

...

Cheers,

Henning

--

Henning Westerholt – https://skalatan.de/blog/

Kamailio services – https://gilawa.com

*From:* sr-users sr-users-bounces@lists.kamailio.org *On Behalf Of *Aymeric Moizard *Sent:* Monday, June 15, 2020 10:31 PM *To:* Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org *Subject:* [SR-Users] MD5 and SHA-256 instead of MD5 or SHA-256...

Hi All,

I'd like to improve my setup by switching to SHA-256.

However, as a first step, I would like to offer both MD5 and SHA-256

in 2 different WWW-Authenticate header.

If I'm correct, this is not doable with the latest auth module?

Is this a planned feature?

As an alternative, I would like to decide the algorithm in the script

instead of a module parameter. It looks to me this is also not doable?

Again, is this a planned feature?

Thanks to all,

Regards

Aymeric

--

Antisip - http://www.antisip.com

-- Antisip - http://www.antisip.com _______________________________________________ Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

On Thu, Jun 18, 2020 at 1:42 AM Olle E. Johansson oej@edvina.net wrote:

On 17 Jun 2020, at 17:22, Maxim Sobolev sobomax@sippysoft.com wrote:

Whoever works on this needs to consider two things I think:

• ability to select algorithms when challenging UAC (MD5-only,

SHA256-only, SHA-512/256-only, all permutations). The RFC allows UAS to include multiple HFs(*). MD5-only should probably be the default. I suspect there might be a significantly non-trivial population of UACs that would get confused receiving multiple digests. Plus enabling challenges for all protocols would expand the size of 401s messages.

Agree, multiple challenges will break stuff. I’m not sure that implementations actually bother with parsing the algorithm parameter.

Sad but true... Checked some of my implementations and not all of them do.

• ability to accept response in either of supported hashing methods or any

combination of thereof. The reasonable default here is probably MD5-only for now, again to prevent the possibility of foul play when we only request MD5, while for some reason getting say SHA-256 back.

If you challenge with SHA512 only, you should not accept anything else.

Right, this is what I am trying to say. Some complications here, namely how do you tell in practice what you have challenged the last transaction with when presented with a particular new request? Impossible in the stateless mode, won't work in the transaction mode (this is a new transaction), and dialog won't help either (no dialog at this point). When the RFC was discussed I suggested the need to expand upon HTTP RFC7616 to allow different nonces for different algorithms which might allow it to be possible and also improve overall security by giving more random bits to more advanced digests. However I got a response that authors trust all decisions made by RFC7616 and don't see any need to improve over that. :(

The only recourse I see with this is to either do some pre-selection based on *whatever* (user-agent, IP, etc) and then challenge/process requests with different but matching flags or store some inter-transaction state somewhere and work from there.

-Max

Le mer. 17 juin 2020 à 08:29, Olle E. Johansson oej@edvina.net a écrit :

Aymeric, Good to hear from you!

;)

There’s been some discussion in the IETF which we haven’t resolved on how to handle this. I think you need to setup different domains or realms each with one auth algorithm. If you offer two at the same time - what’s the point?

I don't understand why using different realm compared to one realm for both would be better?

You are still wide open for downgrade attacks and haven’t accomplished

much.

Today, MD5 is used. If both MD5 and SHA-256 are proposed, it can't be worst in terms of security... It is true that it doesn't bring much!

My intention is to start migration. I guess, today, the safest start is to choose at runtime based on the user-agent or some internal rules. In a later step, the old way would be removed.

If people providing services don't start to use newer algo, there won't be any effort on the endpoint side.

My initial complete objective: (theory) 1/ offer bother md5 and sha-256 to user-agent which still use md5 and which are NOT broken in this mode. (Runtime decision) 2/ offer only sha-256 to user-agent with sha-256 support. 3/ offer only MD5 to user-agent with don't support sha-256 AND are broken if both are offered.

I could also start with point 2 and 3 only, but would prefer to have 1/2/3...

Regards, Aymeric

I guess we will have to wait until the IETF resolves this issue, which

propably applies to more protocols. The big question is how to upgrade a user base to stronger authentication algorithms in HTTP Digest auth without allowing downgrade attacks.

Cheers, /O

On 16 Jun 2020, at 20:42, Henning Westerholt hw@skalatan.de wrote:

Hello,

take a look to this parameter, you can switch between MD5 and SHA256, but only use once at a time:

https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorit...

About planned features – I am not aware of major extensions in this module. Of course, any contribution is welcome.

Cheers,

Henning

-- Henning Westerholt – https://skalatan.de/blog/ Kamailio services – https://gilawa.com

*From:* sr-users sr-users-bounces@lists.kamailio.org *On Behalf Of *Aymeric Moizard *Sent:* Monday, June 15, 2020 10:31 PM *To:* Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org *Subject:* [SR-Users] MD5 and SHA-256 instead of MD5 or SHA-256...

Hi All,

I'd like to improve my setup by switching to SHA-256. However, as a first step, I would like to offer both MD5 and SHA-256 in 2 different WWW-Authenticate header.

If I'm correct, this is not doable with the latest auth module? Is this a planned feature?

As an alternative, I would like to decide the algorithm in the script instead of a module parameter. It looks to me this is also not doable? Again, is this a planned feature?

Thanks to all,

Regards Aymeric

-- Antisip - http://www.antisip.com _______________________________________________ Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

---

Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

On 17 Jun 2020, at 10:58, Aymeric Moizard <amoizard@gmail.com mailto:amoizard@gmail.com> wrote:

Le mer. 17 juin 2020 à 08:29, Olle E. Johansson <oej@edvina.net mailto:oej@edvina.net> a écrit : Aymeric, Good to hear from you!

;)

There’s been some discussion in the IETF which we haven’t resolved on how to handle this. I think you need to setup different domains or realms each with one auth algorithm. If you offer two at the same time - what’s the point?

I don't understand why using different realm compared to one realm for both would be better?

Each realm would have a *SINGLE* auth algorithm.

You are still wide open for downgrade attacks and haven’t accomplished much.

Today, MD5 is used. If both MD5 and SHA-256 are proposed, it can't be worst in terms of security... It is true that it doesn't bring much!

Right, if you think you are raising security, you’re wrong… That’s a problem.

My intention is to start migration. I guess, today, the safest start is to choose at runtime based on the user-agent or some internal rules. In a later step, the old way would be removed.

Maybe, but in many cases that will never happen because you have legacy phones that hang around until the end of time. We need to find a decent way to make segments of your network require stronger algorithms and don’t offer downgrades. Basing that on user-agent headers is not a working solution - and you know it :-)

If people providing services don't start to use newer algo, there won't be any effort on the endpoint side.

My initial complete objective: (theory) 1/ offer bother md5 and sha-256 to user-agent which still use md5 and which are NOT broken in this mode. (Runtime decision) 2/ offer only sha-256 to user-agent with sha-256 support. 3/ offer only MD5 to user-agent with don't support sha-256 AND are broken if both are offered.

I could also start with point 2 and 3 only, but would prefer to have 1/2/3…

Check RFC 8760 for advice and hints on this.

Cheers /O

Regards, Aymeric

I guess we will have to wait until the IETF resolves this issue, which propably applies to more protocols. The big question is how to upgrade a user base to stronger authentication algorithms in HTTP Digest auth without allowing downgrade attacks.

Cheers, /O

...

On 16 Jun 2020, at 20:42, Henning Westerholt <hw@skalatan.de mailto:hw@skalatan.de> wrote:

Hello,

take a look to this parameter, you can switch between MD5 and SHA256, but only use once at a time:

https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorit... https://www.kamailio.org/docs/modules/5.3.x/modules/auth.html#auth.p.algorithm

About planned features – I am not aware of major extensions in this module. Of course, any contribution is welcome.

Cheers,

Henning

-- Henning Westerholt – https://skalatan.de/blog/ https://skalatan.de/blog/ Kamailio services – https://gilawa.com https://gilawa.com/

From: sr-users <sr-users-bounces@lists.kamailio.org mailto:sr-users-bounces@lists.kamailio.org> On Behalf Of Aymeric Moizard Sent: Monday, June 15, 2020 10:31 PM To: Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.org> Subject: [SR-Users] MD5 and SHA-256 instead of MD5 or SHA-256...

Hi All,

I'd like to improve my setup by switching to SHA-256. However, as a first step, I would like to offer both MD5 and SHA-256 in 2 different WWW-Authenticate header.

If I'm correct, this is not doable with the latest auth module? Is this a planned feature?

As an alternative, I would like to decide the algorithm in the script instead of a module parameter. It looks to me this is also not doable? Again, is this a planned feature?

Thanks to all,

Regards Aymeric

-- Antisip - http://www.antisip.com http://www.antisip.com/_______________________________________________ Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

---

Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org mailto:sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users