.TH LOGIN 6.SH NAMElogin \- key exchange protocol.SH DESCRIPTIONThe following encrypted key exchange protocol is used between a client such as.B loginin.IR security-login (2),and a certificate signing process such as.IR logind (8),to justify the latter's issuing a certificate that canlater be presented to an Inferno serviceto establish credentials..PPA shared secret must previously be agreed betweenuser and certifying authority (CA).It is used by the protocol to establish a secure channel between user and CA..PPIn the description below:.TF key(m).PD.TP.I ivecis an 8 byte random number (`initialisation vector') chosen forthis conversation..TP.I shais the 20 byte secure hash (SHA-1) of the password.TP.I keyis an 8 byte secret formed as follows:.EX.brkey[0] = ivec[0]^sha[0]^sha[8]^sha[16]key[1] = ivec[1]^sha[1]^sha[9]^sha[17].EE\&....EXkey[5] = ivec[5]^sha[5]^sha[13];key[6] = ivec[6]^sha[6]^sha[14];key[7] = ivec[7]^sha[7]^sha[15];.EE.TP.I alphais a Diffie-Hellman base used system wide.TP.I pis a Diffie-Hellman modulus used system wide.TP.I "key(m)"is.I mencrypted using the RC4 algorithm with.IR key ..TP.I Rxis a random number of the same order as.IR p ..TP.I "secret"is the Diffie-Hellman secret.IR "alpha**(r0*r1) mod p" ..PPThe protocol follows.  ``user→CA xxx'' means that the usersends the message ``xxx'' to the certifying authority.Any party can send an error instead of a message at anypoint to terminate the protocol..IP.EXuser→CA	nameCA→user	ACK.sp 1vuser→CA	ivecCA→user	key(alpha**r0 mod p), alpha, p.sp 1vuser→CA	alpha**r1 mod pCA→user	CA's public key, SHA(CA's public key + secret).sp 1vuser→CA	user's public key, SHA(user's public key + secret)CA→user	user's public key certificate.EE.PPThe complexity of this protocol is intended to shield the password.To start a clear text attack against the password, oneneeds to first attack the Diffie-Hellman exponentialto determine.IR "alpha**r0 mod p" .A possible weakness is that the encrypted quantityis base64 encoded, constrainingthe possible values of each byte.This could aid a brute force attack..PP.I Alphaand.I pare sent unprotected, though the user code does a few sanity checkson the values it receives.This is another likely point of attack.We should like to know about any..PPThe role of.I ivecis to foil any replay attacks by someone spoofing the CAthough this is probably overkill..SH SEE ALSO.IR security-intro (2),.IR security-login (2),.IR logind (8),.IR signer (8)