Link to home
Start Free TrialLog in
Avatar of rpgeegange
rpgeegange

asked on

Sending the Password over network

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password to send through the network ?

Beside the MITM attacks, can I prevent any brute force or dictionary attacks using complex and long password ?
Avatar of McKnife
McKnife
Flag of Germany image

Please describe more detailed what you are using the password for. Send from where, send to whom, used for what, OS,...

About prevention: same. Please describe how an attacker could proceed in your setup.
Avatar of rpgeegange
rpgeegange

ASKER

Thanks McKnife.

Client Application will send the password encrypted with SHA-512 using RC4 to the server through insecure network.

OS can be any. I'm worrying about the end-to-end communication. Not about how securely storing the password information in the server.

Attacks can be:
MITM, brute-force, dictionary, replay.
Attacker can sniff the traffic also.

TLS/SSL is not an option in my scenario.
Then you still want Diffie–Hellman http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange, which is the exchange of information in the face of the enemy.
Challenge response is another method but not a secure due to bruteforce possibilities or chosen response or downgrade attacks. IPSEC is built into windows, and other OS's, why not use that.
-rich
> Attacker can sniff the traffic also
He can? Has he physical access to the network switches or how does he do that?
About dictionary attacks - I have no idea how fast an attacker could try these passwords. Do you? What would he validate against and is there no anti-hammering/lockout in effect?
"What would he validate against and is there no anti-hammering/lockout in effect?"
this statement is not clear to me.
How would a dictionary attack be done?
Would he have to extract some password hash? [so his attacks would have to validate against the pw hash]. Or would it be an attack against a system that might have incorporated protection against brute force attacks?

Think of someone trying to break a windows password using a script that tries to map a network share using thousands of tries like
net use x: \\server\share /user:username pw1
net use x: \\server\share /user:username pw2
...

[silly example, I know, but it should illustrate what I mean]
Here, breaking would not be possible if a lockout policy were active.
Sniff the challenge response, if any, and break that, it's done easily. Hence my hint at perfect forward secrecy, or use another protocol that has diffel hellman already like ipsec to encapsulate the traffic since SSL isn't available.
Snifing a hashed password is easy for offline guessing. having the account lockout after a few failed attempts is active guessing, and there should be a lockout for that if the author is making his/her own protocol.
-rich
But can the attacker sniff? Are the conditions met?
ASKER CERTIFIED SOLUTION
Avatar of cristiantm
cristiantm
Flag of Brazil image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
https://www.experts-exchange.com/Security/Misc/A_12386-How-secure-are-passwords.html
I'll be adding to it this weekend to cover the ever popular Rainbow Table scenarios and how hashes are obtained in various scenarios.
-rich