Compare commits

...

38 commits

Author SHA1 Message Date
Dag-Erling Smørgrav 646005f031 Remove stray references to OATH.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@906 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-18 09:34:34 +00:00
Dag-Erling Smørgrav 4be13a4e6c merge r768: fix condition for using application-provided prompt
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@905 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 15:19:56 +00:00
Dag-Erling Smørgrav c420e0ac6a merge r768: make stdout line-buffered in unit tests
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@904 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 15:17:55 +00:00
Dag-Erling Smørgrav 6ecf20bc57 r822 claimed to merge r819, r820 and r821 but only merged the first one.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@903 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 15:16:40 +00:00
Dag-Erling Smørgrav aec4e8ad16 merge (r873,r884): add pam_return(8) module used by unit tests
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@901 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:43:27 +00:00
Dag-Erling Smørgrav 335463a9e2 merge r754: tweak option descriptions
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@900 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:40:14 +00:00
Dag-Erling Smørgrav d426d89488 merge r744: run libtoolize before aclocal
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@899 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:38:22 +00:00
Dag-Erling Smørgrav 4860733e29 merge r872: add missing third clause
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@898 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:37:07 +00:00
Dag-Erling Smørgrav 9ce6a3fc2c merge r877: plug hypothetical memory leak
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@897 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:35:09 +00:00
Dag-Erling Smørgrav 204469e6c6 merge r745: (belatedly) add defensive length check to strlcpy()
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@896 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:34:00 +00:00
Dag-Erling Smørgrav c5252af6a8 merge r890: bump copyright dates for files modified in 2014 or later
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@895 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:31:56 +00:00
Dag-Erling Smørgrav debbcc1b75 merge r863,r874,r891: partial unit tests for openpam_dispatch()
merge r864-867,r871,r880,r883: various improvements to tests and test suite


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@894 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:29:41 +00:00
Dag-Erling Smørgrav abee687e7a merge r862: add control flag for fallback to "other" policy
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@893 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:19:04 +00:00
Dag-Erling Smørgrav e86565c553 Completely revert mismerged changes to the documentation Makefile.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@892 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2017-01-17 14:09:49 +00:00
Dag-Erling Smørgrav e30d116c36 stray endif in previous commit
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@856 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2015-01-27 22:34:04 +00:00
Dag-Erling Smørgrav 6b947dd00a merge r787,r830-r840,r845,r852-r853: build and packaging improvements
merge r854: silence all cast-qual warnings except in test suite


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@855 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2015-01-27 22:33:15 +00:00
Dag-Erling Smørgrav 3f96e13f70 merge r828: additional tests for line continuation
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@829 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-10-23 08:26:17 +00:00
Dag-Erling Smørgrav 9700f8606d merge r790, r791: additional tests for openpam_readword()
merge r793: additional tests for openpam_readlinev()


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@826 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-10-18 22:42:23 +00:00
Dag-Erling Smørgrav 918f37acdc merge r792: support line continuation in whitespace.
merge r824: remove unused variable.


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@825 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-10-18 22:38:31 +00:00
Dag-Erling Smørgrav a27043ec13 merge r819, r820, r821: improvements to history2wiki
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@822 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-10-09 15:15:42 +00:00
Dag-Erling Smørgrav 18ca38b81c merge r813: credit Gavin Atkinson
merge r814: autotools nits


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@815 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-12 07:47:27 +00:00
Dag-Erling Smørgrav 590fc39338 merge r811: push back release date
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@812 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-12 07:24:23 +00:00
Dag-Erling Smørgrav 9f736ec8f4 merge r809: typo
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@810 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-09 11:02:16 +00:00
Dag-Erling Smørgrav ed0929dcc0 merge r766, r767: fix svn:ignore
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@808 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-09 09:43:48 +00:00
Dag-Erling Smørgrav 89f5473b9d merge r802: require at least one service function to have succeeded.
merge r803: introduce strlset() and use it to clear authentication tokens
merge r804: remove keywords from text files
merge r805: include CVE numbers in change log
merge r806: prepare to release Ourouparia


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@807 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-09 09:41:32 +00:00
Dag-Erling Smørgrav bdb75a6c92 merge r800: belatedly document support for module search paths
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@801 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-09-08 12:43:20 +00:00
Dag-Erling Smørgrav 79670fe2fb merge r797: add a missing cast
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@798 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-06-10 21:28:14 +00:00
Dag-Erling Smørgrav 4685f783f4 merge r795: fix error handling for nonexistent modules (CVE-2014-3879)
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@796 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-06-03 21:30:08 +00:00
Dag-Erling Smørgrav c87d7f0ff0 merge r759: add is_xdigit() predicate
merge r760: add tests for ctype macros
merge r761: fix bug in is_upper()
merge r762: update credits


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@763 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-02-26 16:29:16 +00:00
Dag-Erling Smørgrav efb78b5569 merge r748: typo in pam_conv(3) man page
merge r749: update mkpkgng for pkg 1.2
merge r750: credit bapt@freebsd.org


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@751 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2014-01-13 21:34:29 +00:00
Dag-Erling Smørgrav 00df607198 merge r746: typos in man pages
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@747 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-12-10 14:03:16 +00:00
Dag-Erling Smørgrav c3cacd763a merge r742: caught_signal should be static.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@743 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-09-07 19:26:36 +00:00
Dag-Erling Smørgrav 05d3310d7e sort the manifest
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@740 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-09-07 13:03:20 +00:00
Dag-Erling Smørgrav e2fcd142ce s/trunk/nooath/
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@738 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-09-07 12:56:31 +00:00
Dag-Erling Smørgrav 60d3d1dae7 Prepare for OpenPAM Nummularia.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@737 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-09-07 12:53:55 +00:00
Dag-Erling Smørgrav 83162901d4 Catch up with trunk
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@736 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-09-07 12:52:42 +00:00
Dag-Erling Smørgrav fd3a018fbf merge 717: svn:ignore test output and logs
merge 718, 719: improved man page dependency handling


git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@720 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-08-19 16:02:10 +00:00
Dag-Erling Smørgrav efcf4a9ec6 Create a nooath branch as a copy of trunk@713 with the OATH code removed.
git-svn-id: svn+ssh://svn.openpam.org/svn/openpam/branches/nooath@714 185d5e19-27fe-0310-9dcf-9bff6b9f3609
2013-08-19 15:30:21 +00:00
78 changed files with 1255 additions and 14981 deletions

11
CREDITS
View file

@ -15,23 +15,27 @@ directly or indirectly, with patches, criticism, suggestions, or
ideas:
Andrew Morgan <morgan@transmeta.com>
Ankita Pal <pal.ankita.ankita@gmail.com>
Baptiste Daroussin <bapt@freebsd.org>
Brian Fundakowski Feldman <green@freebsd.org>
Christos Zoulas <christos@netbsd.org>
Daniel Richard G. <skunk@iskunk.org>
Darren J. Moffat <darren.moffat@sun.com>
Dimitry Andric <dim@freebsd.org>
Dmitry V. Levin <ldv@altlinux.org>
Don Lewis <truckman@freebsd.org>
Emmanuel Dreyfus <manu@netbsd.org>
Eric Melville <eric@freebsd.org>
Espen Grøndahl <espegro@usit.uio.no>
Gary Winiger <gary.winiger@sun.com>
Gavin Atkinson <gavin@freebsd.org>
Gleb Smirnoff <glebius@freebsd.org>
Hubert Feyrer <hubert@feyrer.de>
Jason Evans <jasone@freebsd.org>
Joe Marcus Clarke <marcus@freebsd.org>
Juli Mallett <jmallett@freebsd.org>
Ankita Pal <pal.ankita.ankita@gmail.com>
Jörg Sonnenberger <joerg@britannica.bec.de>
Juli Mallett <jmallett@freebsd.org>
Larry Baird <lab@gta.com>
Maëlle Lesage <lesage.maelle@gmail.com>
Mark Murray <markm@freebsd.org>
Matthias Drochner <drochner@netbsd.org>
@ -39,6 +43,7 @@ ideas:
Mikhail Teterin <mi@aldan.algebra.com>
Mikko Työläjärvi <mbsd@pacbell.net>
Nick Hibma <nick@van-laarhoven.org>
Patrick Bihan-Faou <patrick-fbsd@mindstep.com>
Robert Watson <rwatson@freebsd.org>
Ruslan Ermilov <ru@freebsd.org>
Sebastian Krahmer <sebastian.krahmer@gmail.com>
@ -46,5 +51,3 @@ ideas:
Takanori Saneto <sanewo@ba2.so-net.ne.jp>
Wojciech A. Koszek <wkoszek@freebsd.org>
Yar Tikhiy <yar@freebsd.org>
$Id$

28
HISTORY
View file

@ -1,7 +1,25 @@
OpenPAM ?????????? 2013-??-??
OpenPAM Ourouparia 2014-09-12
- FEATURE: Add a pam_oath module that implements RFC 4226 (HOTP) and
RFC 6238 (TOTP).
- ENHANCE: When executing a chain, require at least one service
function to succeed. This mitigates fail-open scenarios caused by
misconfigurations or missing modules.
- ENHANCE: Make sure to overwrite buffers which may have contained an
authentication token when they're no longer needed.
- BUGFIX: Under certain circumstances, specifying a non-existent
module (or misspelling the name of a module) in a policy could
result in a fail-open scenario. (CVE-2014-3879)
- FEATURE: Add a search path for modules. This was implemented in
Nummularia but inadvertently left out of the release notes.
- BUGFIX: The is_upper() predicate only accepted the letter A as an
upper-case character instead of the entire A-Z range. As a result,
service and module names containing upper-case letters other than A
would be rejected.
============================================================================
OpenPAM Nummularia 2013-09-07
- ENHANCE: Rewrite the dynamic loader to improve readability and
reliability. Modules can now be listed without the ".so" suffix in
@ -100,7 +118,7 @@ OpenPAM Lycopsida 2011-12-18
module before loading it.
- ENHANCE: added / improved input validation in many cases, including
the policy file and some function arguments.
the policy file and some function arguments. (CVE-2011-4122)
============================================================================
OpenPAM Hydrangea 2007-12-21
@ -430,5 +448,3 @@ Fixed a number of bugs in the previous release, including:
OpenPAM Calamite 2002-02-09
First (beta) release.
============================================================================
$Id$

View file

@ -54,5 +54,3 @@
directory:
# make install
$Id$

View file

@ -1,6 +1,6 @@
Copyright (c) 2002-2003 Networks Associates Technology, Inc.
Copyright (c) 2004-2012 Dag-Erling Smørgrav
Copyright (c) 2004-2017 Dag-Erling Smørgrav
All rights reserved.
This software was developed for the FreeBSD Project by ThinkSec AS and
@ -31,5 +31,3 @@ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
$Id$

17
README
View file

@ -7,21 +7,4 @@ implementations disagree, OpenPAM tries to remain compatible with
Solaris, at the expense of XSSO conformance and Linux-PAM
compatibility.
These are some of OpenPAM's features:
- Implements the complete PAM API as described in the original PAM
paper and in OSF-RFC 86.0; this corresponds to the full XSSO API
except for mappings and secondary authentication. Also
implements some extensions found in Solaris 9.
- Extends the API with several useful and time-saving functions.
- Performs strict checking of return values from service modules.
- Reads configuration from /etc/pam.d/, /etc/pam.conf,
/usr/local/etc/pam.d/ and /usr/local/etc/pam.conf, in that order;
this will be made configurable in a future release.
Please direct bug reports and inquiries to <des@des.no>.
$Id$

View file

@ -1,6 +1,6 @@
Release notes for OpenPAM ????????
==================================
Release notes for OpenPAM Ourouparia
====================================
This release corresponds to the code used in FreeBSD HEAD as of the
release date, and is also expected to work on almost any POSIX-like
@ -17,13 +17,6 @@ The distribution consists of the following components:
- A test application (pamtest) which can be used to test policies and
modules.
- A library which implements the OATH one-time password algorithms,
with complete API documentation.
- A PAM module which implements OATH-based authentication.
- Unit tests for limited portions of the libraries.
Please direct bug reports and inquiries to <des@des.no>.
$Id$

10
TODO
View file

@ -1,8 +1,5 @@
Before the next release:
- Add oath_alloc_secure() which allocates memory using mmap() +
mlock() and oath_free_secure() which wipes and frees it.
- Rewrite openpam_ttyconv(3).
- mostly done, needs review.
@ -10,8 +7,9 @@ Before the next release:
documentation are slightly incorrect, OpenPAM's pam_unix(8) is
incorrect, all FreeBSD modules are broken)
- Finish pam_oath(8) and oathkey(1).
- Add loop detection to openpam_load_chain().
$Id$
- Look into the possibility of implementing a version of (or a
wrapper for) openpam_log() which respects the PAM_SILENT flag and
the no_warn module option. This would eliminate the need for
FreeBSD's _pam_verbose_error().

View file

@ -10,8 +10,20 @@ set -ex
# autoconf prior to 2.62 has issues with zsh 4.2 and newer
export CONFIG_SHELL=/bin/sh
# BullseyeCoverage needs to know exactly which compiler we're using
if [ -z "$CC" -a -z "$CPP" -a -z "$CXX" ] ; then
if $(which clang clang++ >/dev/null) ; then
export CC=${CC:-clang}
export CPP=${CPP:-clang -E}
export CXX=${CXX:-clang++}
elif $(which gcc g++ >/dev/null) ; then
export CC=${CC:-gcc}
export CPP=${CPP:-gcc -E}
export CXX=${CXX:-g++}
fi
fi
./configure \
--with-oath \
--with-doc \
--with-pam-unix \
--with-pamtest \

View file

@ -3,8 +3,8 @@
# $Id$
#
aclocal -I m4
libtoolize --copy --force
aclocal -I m4
autoheader
automake -a -c --foreign
automake --add-missing --copy --foreign
autoconf

View file

@ -4,4 +4,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/lib/libpam
noinst_PROGRAMS = openpam_dump_policy
openpam_dump_policy_SOURCES = openpam_dump_policy.c
if WITH_SYSTEM_LIBPAM
openpam_dump_policy_LDADD = $(SYSTEM_LIBPAM)
else
openpam_dump_policy_LDADD = $(top_builddir)/lib/libpam/libpam.la
endif

View file

@ -1,5 +1,5 @@
/*-
* Copyright (c) 2011 Dag-Erling Smørgrav
* Copyright (c) 2011-2014 Dag-Erling Smørgrav
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@ -64,7 +64,7 @@ openpam_facility_index_name(pam_facility_t fclt)
if (asprintf(&name, "PAM_%s", facility) == -1)
return (NULL);
for (p = name + 4; *p; ++p)
*p = toupper(*p);
*p = toupper((unsigned char)*p);
return (name);
}

View file

@ -4,6 +4,10 @@ AM_CPPFLAGS = -I$(top_srcdir)/include
bin_PROGRAMS = pamtest
pamtest_SOURCES = pamtest.c
if WITH_SYSTEM_LIBPAM
pamtest_LDADD = $(SYSTEM_LIBPAM)
else
pamtest_LDADD = $(top_builddir)/lib/libpam/libpam.la
endif
dist_man1_MANS = pamtest.1

View file

@ -34,7 +34,7 @@
.Sh NAME
.Nm pamtest
.Nd PAM policy tester
.Sh SYNOPSYS
.Sh SYNOPSIS
.Nm
.Op Fl dkMPsv
.Op Fl H Ar rhost

View file

@ -4,6 +4,10 @@ AM_CPPFLAGS = -I$(top_srcdir)/include
bin_PROGRAMS = su
su_SOURCES = su.c
if WITH_SYSTEM_LIBPAM
su_LDADD = $(SYSTEM_LIBPAM)
else
su_LDADD = $(top_builddir)/lib/libpam/libpam.la
endif
dist_man1_MANS = su.1

View file

@ -34,7 +34,7 @@
.Sh NAME
.Nm su
.Nd switch user identity
.Sh SYNOPSYS
.Sh SYNOPSIS
.Nm
.Op Ar login Op Ar ...
.Sh DESCRIPTION

View file

@ -2,7 +2,7 @@ dnl $Id$
AC_PREREQ([2.62])
AC_REVISION([$Id$])
AC_INIT([OpenPAM], [trunk], [des@des.no], [openpam], [http://www.openpam.org/])
AC_INIT([OpenPAM], [nooath], [des@des.no], [openpam], [http://www.openpam.org/])
AC_CONFIG_SRCDIR([lib/libpam/pam_start.c])
AC_CONFIG_MACRO_DIR([m4])
AM_INIT_AUTOMAKE([foreign])
@ -62,36 +62,36 @@ AC_ARG_WITH([doc],
AM_CONDITIONAL([WITH_DOC], [test x"$with_doc" = x"yes"])
AC_ARG_WITH([pam-unix],
AC_HELP_STRING([--with-pam-unix], [compile sample pam_unix(8) module]),
AC_HELP_STRING([--with-pam-unix], [build sample pam_unix(8) module]),
[],
[with_pam_unix=no])
AM_CONDITIONAL([WITH_PAM_UNIX], [test x"$with_pam_unix" = x"yes"])
AC_ARG_WITH([oath],
AC_HELP_STRING([--with-oath], [compile OATH library, module and utility]),
[],
[with_oath=no])
AM_CONDITIONAL([WITH_OATH], [test x"$with_oath" = x"yes"])
AC_ARG_WITH(pamtest,
AC_HELP_STRING([--with-pamtest], [compile test application]),
AC_HELP_STRING([--with-pamtest], [build test application]),
[],
[with_pamtest=no])
AM_CONDITIONAL([WITH_PAMTEST], [test x"$with_pamtest" = x"yes"])
AC_ARG_WITH(su,
AC_HELP_STRING([--with-su], [compile sample su(1) implementation]),
AC_HELP_STRING([--with-su], [build sample su(1) implementation]),
[],
[with_su=no])
AM_CONDITIONAL([WITH_SU], [test x"$with_su" = x"yes"])
AC_ARG_WITH(system-libpam,
AC_HELP_STRING([--with-system-libpam], [use system libpam]),
[],
[with_system_libpam=no])
AM_CONDITIONAL([WITH_SYSTEM_LIBPAM], [test x"$with_system_libpam" = x"yes"])
AC_CHECK_HEADERS([crypt.h])
AC_CHECK_FUNCS([asprintf vasprintf])
AC_CHECK_FUNCS([dlfunc fdlopen])
AC_CHECK_FUNCS([fpurge])
AC_CHECK_FUNCS([setlogmask])
AC_CHECK_FUNCS([strlcat strlcmp strlcpy])
AC_CHECK_FUNCS([strlcat strlcmp strlcpy strlset])
saved_LIBS="${LIBS}"
LIBS=""
@ -114,9 +114,16 @@ CRYPTO_LIBS="${LIBS}"
LIBS="${saved_LIBS}"
AC_SUBST(CRYPTO_LIBS)
saved_LIBS="${LIBS}"
LIBS=""
AC_CHECK_LIB([pam], [pam_start])
SYSTEM_LIBPAM="${LIBS}"
LIBS="${saved_LIBS}"
AC_SUBST(SYSTEM_LIBPAM)
AC_ARG_ENABLE([developer-warnings],
AS_HELP_STRING([--enable-developer-warnings], [enable strict warnings (default is NO)]),
[CFLAGS="${CFLAGS} -Wall -Wextra"])
[CFLAGS="${CFLAGS} -Wall -Wextra -Wcast-qual"])
AC_ARG_ENABLE([debugging-symbols],
AS_HELP_STRING([--enable-debugging-symbols], [enable debugging symbols (default is NO)]),
[CFLAGS="${CFLAGS} -O0 -g -fno-inline"])
@ -135,15 +142,13 @@ AC_CONFIG_FILES([
include/Makefile
include/security/Makefile
lib/Makefile
lib/liboath/Makefile
lib/libpam/Makefile
modules/Makefile
modules/pam_deny/Makefile
modules/pam_permit/Makefile
modules/pam_return/Makefile
modules/pam_unix/Makefile
modules/pam_oath/Makefile
t/Makefile
])
AC_CONFIG_FILES([pamgdb],[chmod +x pamgdb])
AC_CONFIG_FILES([mkpkgng],[chmod +x mkpkgng])
AC_OUTPUT

View file

@ -64,12 +64,13 @@ OMAN = \
EXTRA_DIST = openpam.man pam.man
ALLCMAN = $(PMAN) $(MMAN) $(OMAN)
GENMAN = $(ALLCMAN) openpam.3 pam.3
dist_man3_MANS = $(ALLCMAN) openpam.3 pam.3 pam_conv.3
dist_man3_MANS = $(GENMAN) pam_conv.3
dist_man5_MANS = pam.conf.5
CLEANFILES = $(ALLCMAN) openpam.3 pam.3
CLEANFILES = $(GENMAN)
GENDOC = $(top_srcdir)/misc/gendoc.pl
@ -80,10 +81,12 @@ VPATH = $(LIBSRCDIR) $(srcdir)
SUFFIXES = .3
.c.3: $(GENDOC)
perl -w $(GENDOC) $<
perl -w $(GENDOC) $< || rm $@
openpam.3: $(OMAN) $(GENDOC) $(srcdir)/openpam.man
perl -w $(GENDOC) -o $(abs_srcdir)/$(OMAN) <$(srcdir)/openpam.man
openpam.3: $(OPENPAM_MAN) $(GENDOC) $(srcdir)/openpam.man
perl -w $(GENDOC) -o $(OPENPAM_MAN) <$(srcdir)/openpam.man || rm $@
pam.3: $(PMAN) $(GENDOC) $(srcdir)/pam.man
perl -w $(GENDOC) -p $(abs_srcdir)/$(PMAN) <$(srcdir)/pam.man
pam.3: $(PAM_MAN) $(GENDOC) $(srcdir)/pam.man
perl -w $(GENDOC) -p $(PAM_MAN) <$(srcdir)/pam.man || rm $@
$(GENMAN): $(GENDOC)

View file

@ -1,6 +1,6 @@
.\"-
.\" Copyright (c) 2002-2003 Networks Associates Technology, Inc.
.\" Copyright (c) 2004-2011 Dag-Erling Smørgrav
.\" Copyright (c) 2004-2014 Dag-Erling Smørgrav
.\" All rights reserved.
.\"
.\" This software was developed for the FreeBSD Project by ThinkSec AS and
@ -76,7 +76,7 @@ item.
.Pp
The conversation function's first argument specifies the number of
messages (up to
.Dv PAM_NUM_MSG )
.Dv PAM_MAX_NUM_MSG )
to process.
The second argument is a pointer to an array of pointers to
.Vt pam_message

File diff suppressed because it is too large Load diff

View file

@ -1,619 +0,0 @@
Network Working Group H. Krawczyk
Request for Comments: 2104 IBM
Category: Informational M. Bellare
UCSD
R. Canetti
IBM
February 1997
HMAC: Keyed-Hashing for Message Authentication
Status of This Memo
This memo provides information for the Internet community. This memo
does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.
Abstract
This document describes HMAC, a mechanism for message authentication
using cryptographic hash functions. HMAC can be used with any
iterative cryptographic hash function, e.g., MD5, SHA-1, in
combination with a secret shared key. The cryptographic strength of
HMAC depends on the properties of the underlying hash function.
1. Introduction
Providing a way to check the integrity of information transmitted
over or stored in an unreliable medium is a prime necessity in the
world of open computing and communications. Mechanisms that provide
such integrity check based on a secret key are usually called
"message authentication codes" (MAC). Typically, message
authentication codes are used between two parties that share a secret
key in order to validate information transmitted between these
parties. In this document we present such a MAC mechanism based on
cryptographic hash functions. This mechanism, called HMAC, is based
on work by the authors [BCK1] where the construction is presented and
cryptographically analyzed. We refer to that work for the details on
the rationale and security analysis of HMAC, and its comparison to
other keyed-hash methods.
Krawczyk, et. al. Informational [Page 1]
RFC 2104 HMAC February 1997
HMAC can be used in combination with any iterated cryptographic hash
function. MD5 and SHA-1 are examples of such hash functions. HMAC
also uses a secret key for calculation and verification of the
message authentication values. The main goals behind this
construction are
* To use, without modifications, available hash functions.
In particular, hash functions that perform well in software,
and for which code is freely and widely available.
* To preserve the original performance of the hash function without
incurring a significant degradation.
* To use and handle keys in a simple way.
* To have a well understood cryptographic analysis of the strength of
the authentication mechanism based on reasonable assumptions on the
underlying hash function.
* To allow for easy replaceability of the underlying hash function in
case that faster or more secure hash functions are found or
required.
This document specifies HMAC using a generic cryptographic hash
function (denoted by H). Specific instantiations of HMAC need to
define a particular hash function. Current candidates for such hash
functions include SHA-1 [SHA], MD5 [MD5], RIPEMD-128/160 [RIPEMD].
These different realizations of HMAC will be denoted by HMAC-SHA1,
HMAC-MD5, HMAC-RIPEMD, etc.
Note: To the date of writing of this document MD5 and SHA-1 are the
most widely used cryptographic hash functions. MD5 has been recently
shown to be vulnerable to collision search attacks [Dobb]. This
attack and other currently known weaknesses of MD5 do not compromise
the use of MD5 within HMAC as specified in this document (see
[Dobb]); however, SHA-1 appears to be a cryptographically stronger
function. To this date, MD5 can be considered for use in HMAC for
applications where the superior performance of MD5 is critical. In
any case, implementers and users need to be aware of possible
cryptanalytic developments regarding any of these cryptographic hash
functions, and the eventual need to replace the underlying hash
function. (See section 6 for more information on the security of
HMAC.)
Krawczyk, et. al. Informational [Page 2]
RFC 2104 HMAC February 1997
2. Definition of HMAC
The definition of HMAC requires a cryptographic hash function, which
we denote by H, and a secret key K. We assume H to be a cryptographic
hash function where data is hashed by iterating a basic compression
function on blocks of data. We denote by B the byte-length of such
blocks (B=64 for all the above mentioned examples of hash functions),
and by L the byte-length of hash outputs (L=16 for MD5, L=20 for
SHA-1). The authentication key K can be of any length up to B, the
block length of the hash function. Applications that use keys longer
than B bytes will first hash the key using H and then use the
resultant L byte string as the actual key to HMAC. In any case the
minimal recommended length for K is L bytes (as the hash output
length). See section 3 for more information on keys.
We define two fixed and different strings ipad and opad as follows
(the 'i' and 'o' are mnemonics for inner and outer):
ipad = the byte 0x36 repeated B times
opad = the byte 0x5C repeated B times.
To compute HMAC over the data `text' we perform
H(K XOR opad, H(K XOR ipad, text))
Namely,
(1) append zeros to the end of K to create a B byte string
(e.g., if K is of length 20 bytes and B=64, then K will be
appended with 44 zero bytes 0x00)
(2) XOR (bitwise exclusive-OR) the B byte string computed in step
(1) with ipad
(3) append the stream of data 'text' to the B byte string resulting
from step (2)
(4) apply H to the stream generated in step (3)
(5) XOR (bitwise exclusive-OR) the B byte string computed in
step (1) with opad
(6) append the H result from step (4) to the B byte string
resulting from step (5)
(7) apply H to the stream generated in step (6) and output
the result
For illustration purposes, sample code based on MD5 is provided as an
appendix.
Krawczyk, et. al. Informational [Page 3]
RFC 2104 HMAC February 1997
3. Keys
The key for HMAC can be of any length (keys longer than B bytes are
first hashed using H). However, less than L bytes is strongly
discouraged as it would decrease the security strength of the
function. Keys longer than L bytes are acceptable but the extra
length would not significantly increase the function strength. (A
longer key may be advisable if the randomness of the key is
considered weak.)
Keys need to be chosen at random (or using a cryptographically strong
pseudo-random generator seeded with a random seed), and periodically
refreshed. (Current attacks do not indicate a specific recommended
frequency for key changes as these attacks are practically
infeasible. However, periodic key refreshment is a fundamental
security practice that helps against potential weaknesses of the
function and keys, and limits the damage of an exposed key.)
4. Implementation Note
HMAC is defined in such a way that the underlying hash function H can
be used with no modification to its code. In particular, it uses the
function H with the pre-defined initial value IV (a fixed value
specified by each iterative hash function to initialize its
compression function). However, if desired, a performance
improvement can be achieved at the cost of (possibly) modifying the
code of H to support variable IVs.
The idea is that the intermediate results of the compression function
on the B-byte blocks (K XOR ipad) and (K XOR opad) can be precomputed
only once at the time of generation of the key K, or before its first
use. These intermediate results are stored and then used to
initialize the IV of H each time that a message needs to be
authenticated. This method saves, for each authenticated message,
the application of the compression function of H on two B-byte blocks
(i.e., on (K XOR ipad) and (K XOR opad)). Such a savings may be
significant when authenticating short streams of data. We stress
that the stored intermediate values need to be treated and protected
the same as secret keys.
Choosing to implement HMAC in the above way is a decision of the
local implementation and has no effect on inter-operability.
Krawczyk, et. al. Informational [Page 4]
RFC 2104 HMAC February 1997
5. Truncated output
A well-known practice with message authentication codes is to
truncate the output of the MAC and output only part of the bits
(e.g., [MM, ANSI]). Preneel and van Oorschot [PV] show some
analytical advantages of truncating the output of hash-based MAC
functions. The results in this area are not absolute as for the
overall security advantages of truncation. It has advantages (less
information on the hash result available to an attacker) and
disadvantages (less bits to predict for the attacker). Applications
of HMAC can choose to truncate the output of HMAC by outputting the t
leftmost bits of the HMAC computation for some parameter t (namely,
the computation is carried in the normal way as defined in section 2
above but the end result is truncated to t bits). We recommend that
the output length t be not less than half the length of the hash
output (to match the birthday attack bound) and not less than 80 bits
(a suitable lower bound on the number of bits that need to be
predicted by an attacker). We propose denoting a realization of HMAC
that uses a hash function H with t bits of output as HMAC-H-t. For
example, HMAC-SHA1-80 denotes HMAC computed using the SHA-1 function
and with the output truncated to 80 bits. (If the parameter t is not
specified, e.g. HMAC-MD5, then it is assumed that all the bits of the
hash are output.)
6. Security
The security of the message authentication mechanism presented here
depends on cryptographic properties of the hash function H: the
resistance to collision finding (limited to the case where the
initial value is secret and random, and where the output of the
function is not explicitly available to the attacker), and the
message authentication property of the compression function of H when
applied to single blocks (in HMAC these blocks are partially unknown
to an attacker as they contain the result of the inner H computation
and, in particular, cannot be fully chosen by the attacker).
These properties, and actually stronger ones, are commonly assumed
for hash functions of the kind used with HMAC. In particular, a hash
function for which the above properties do not hold would become
unsuitable for most (probably, all) cryptographic applications,
including alternative message authentication schemes based on such
functions. (For a complete analysis and rationale of the HMAC
function the reader is referred to [BCK1].)
Krawczyk, et. al. Informational [Page 5]
RFC 2104 HMAC February 1997
Given the limited confidence gained so far as for the cryptographic
strength of candidate hash functions, it is important to observe the
following two properties of the HMAC construction and its secure use
for message authentication:
1. The construction is independent of the details of the particular
hash function H in use and then the latter can be replaced by any
other secure (iterative) cryptographic hash function.
2. Message authentication, as opposed to encryption, has a
"transient" effect. A published breaking of a message authentication
scheme would lead to the replacement of that scheme, but would have
no adversarial effect on information authenticated in the past. This
is in sharp contrast with encryption, where information encrypted
today may suffer from exposure in the future if, and when, the
encryption algorithm is broken.
The strongest attack known against HMAC is based on the frequency of
collisions for the hash function H ("birthday attack") [PV,BCK2], and
is totally impractical for minimally reasonable hash functions.
As an example, if we consider a hash function like MD5 where the
output length equals L=16 bytes (128 bits) the attacker needs to
acquire the correct message authentication tags computed (with the
_same_ secret key K!) on about 2**64 known plaintexts. This would
require the processing of at least 2**64 blocks under H, an
impossible task in any realistic scenario (for a block length of 64
bytes this would take 250,000 years in a continuous 1Gbps link, and
without changing the secret key K during all this time). This attack
could become realistic only if serious flaws in the collision
behavior of the function H are discovered (e.g. collisions found
after 2**30 messages). Such a discovery would determine the immediate
replacement of the function H (the effects of such failure would be
far more severe for the traditional uses of H in the context of
digital signatures, public key certificates, etc.).
Note: this attack needs to be strongly contrasted with regular
collision attacks on cryptographic hash functions where no secret key
is involved and where 2**64 off-line parallelizable (!) operations
suffice to find collisions. The latter attack is approaching
feasibility [VW] while the birthday attack on HMAC is totally
impractical. (In the above examples, if one uses a hash function
with, say, 160 bit of output then 2**64 should be replaced by 2**80.)
Krawczyk, et. al. Informational [Page 6]
RFC 2104 HMAC February 1997
A correct implementation of the above construction, the choice of
random (or cryptographically pseudorandom) keys, a secure key
exchange mechanism, frequent key refreshments, and good secrecy
protection of keys are all essential ingredients for the security of
the integrity verification mechanism provided by HMAC.
Krawczyk, et. al. Informational [Page 7]
RFC 2104 HMAC February 1997
Appendix -- Sample Code
For the sake of illustration we provide the following sample code for
the implementation of HMAC-MD5 as well as some corresponding test
vectors (the code is based on MD5 code as described in [MD5]).
/*
** Function: hmac_md5
*/
void
hmac_md5(text, text_len, key, key_len, digest)
unsigned char* text; /* pointer to data stream */
int text_len; /* length of data stream */
unsigned char* key; /* pointer to authentication key */
int key_len; /* length of authentication key */
caddr_t digest; /* caller digest to be filled in */
{
MD5_CTX context;
unsigned char k_ipad[65]; /* inner padding -
* key XORd with ipad
*/
unsigned char k_opad[65]; /* outer padding -
* key XORd with opad
*/
unsigned char tk[16];
int i;
/* if key is longer than 64 bytes reset it to key=MD5(key) */
if (key_len > 64) {
MD5_CTX tctx;
MD5Init(&tctx);
MD5Update(&tctx, key, key_len);
MD5Final(tk, &tctx);
key = tk;
key_len = 16;
}
/*
* the HMAC_MD5 transform looks like:
*
* MD5(K XOR opad, MD5(K XOR ipad, text))
*
* where K is an n byte key
* ipad is the byte 0x36 repeated 64 times
Krawczyk, et. al. Informational [Page 8]
RFC 2104 HMAC February 1997
* opad is the byte 0x5c repeated 64 times
* and text is the data being protected
*/
/* start out by storing key in pads */
bzero( k_ipad, sizeof k_ipad);
bzero( k_opad, sizeof k_opad);
bcopy( key, k_ipad, key_len);
bcopy( key, k_opad, key_len);
/* XOR key with ipad and opad values */
for (i=0; i<64; i++) {
k_ipad[i] ^= 0x36;
k_opad[i] ^= 0x5c;
}
/*
* perform inner MD5
*/
MD5Init(&context); /* init context for 1st
* pass */
MD5Update(&context, k_ipad, 64) /* start with inner pad */
MD5Update(&context, text, text_len); /* then text of datagram */
MD5Final(digest, &context); /* finish up 1st pass */
/*
* perform outer MD5
*/
MD5Init(&context); /* init context for 2nd
* pass */
MD5Update(&context, k_opad, 64); /* start with outer pad */
MD5Update(&context, digest, 16); /* then results of 1st
* hash */
MD5Final(digest, &context); /* finish up 2nd pass */
}
Test Vectors (Trailing '\0' of a character string not included in test):
key = 0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len = 16 bytes
data = "Hi There"
data_len = 8 bytes
digest = 0x9294727a3638bb1c13f48ef8158bfc9d
key = "Jefe"
data = "what do ya want for nothing?"
data_len = 28 bytes
digest = 0x750c783e6ab0b503eaa86e310a5db738
key = 0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Krawczyk, et. al. Informational [Page 9]
RFC 2104 HMAC February 1997
key_len 16 bytes
data = 0xDDDDDDDDDDDDDDDDDDDD...
..DDDDDDDDDDDDDDDDDDDD...
..DDDDDDDDDDDDDDDDDDDD...
..DDDDDDDDDDDDDDDDDDDD...
..DDDDDDDDDDDDDDDDDDDD
data_len = 50 bytes
digest = 0x56be34521d144c88dbb8c733f0e8b3f6
Acknowledgments
Pau-Chen Cheng, Jeff Kraemer, and Michael Oehler, have provided
useful comments on early drafts, and ran the first interoperability
tests of this specification. Jeff and Pau-Chen kindly provided the
sample code and test vectors that appear in the appendix. Burt
Kaliski, Bart Preneel, Matt Robshaw, Adi Shamir, and Paul van
Oorschot have provided useful comments and suggestions during the
investigation of the HMAC construction.
References
[ANSI] ANSI X9.9, "American National Standard for Financial
Institution Message Authentication (Wholesale)," American
Bankers Association, 1981. Revised 1986.
[Atk] Atkinson, R., "IP Authentication Header", RFC 1826, August
1995.
[BCK1] M. Bellare, R. Canetti, and H. Krawczyk,
"Keyed Hash Functions and Message Authentication",
Proceedings of Crypto'96, LNCS 1109, pp. 1-15.
(http://www.research.ibm.com/security/keyed-md5.html)
[BCK2] M. Bellare, R. Canetti, and H. Krawczyk,
"Pseudorandom Functions Revisited: The Cascade Construction",
Proceedings of FOCS'96.
[Dobb] H. Dobbertin, "The Status of MD5 After a Recent Attack",
RSA Labs' CryptoBytes, Vol. 2 No. 2, Summer 1996.
http://www.rsa.com/rsalabs/pubs/cryptobytes.html
[PV] B. Preneel and P. van Oorschot, "Building fast MACs from hash
functions", Advances in Cryptology -- CRYPTO'95 Proceedings,
Lecture Notes in Computer Science, Springer-Verlag Vol.963,
1995, pp. 1-14.
[MD5] Rivest, R., "The MD5 Message-Digest Algorithm",
RFC 1321, April 1992.
Krawczyk, et. al. Informational [Page 10]
RFC 2104 HMAC February 1997
[MM] Meyer, S. and Matyas, S.M., Cryptography, New York Wiley,
1982.
[RIPEMD] H. Dobbertin, A. Bosselaers, and B. Preneel, "RIPEMD-160: A
strengthened version of RIPEMD", Fast Software Encryption,
LNCS Vol 1039, pp. 71-82.
ftp://ftp.esat.kuleuven.ac.be/pub/COSIC/bosselae/ripemd/.
[SHA] NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.
[Tsu] G. Tsudik, "Message authentication with one-way hash
functions", In Proceedings of Infocom'92, May 1992.
(Also in "Access Control and Policy Enforcement in
Internetworks", Ph.D. Dissertation, Computer Science
Department, University of Southern California, April 1991.)
[VW] P. van Oorschot and M. Wiener, "Parallel Collision
Search with Applications to Hash Functions and Discrete
Logarithms", Proceedings of the 2nd ACM Conf. Computer and
Communications Security, Fairfax, VA, November 1994.
Authors' Addresses
Hugo Krawczyk
IBM T.J. Watson Research Center
P.O.Box 704
Yorktown Heights, NY 10598
EMail: hugo@watson.ibm.com
Mihir Bellare
Dept of Computer Science and Engineering
Mail Code 0114
University of California at San Diego
9500 Gilman Drive
La Jolla, CA 92093
EMail: mihir@cs.ucsd.edu
Ran Canetti
IBM T.J. Watson Research Center
P.O.Box 704
Yorktown Heights, NY 10598
EMail: canetti@watson.ibm.com
Krawczyk, et. al. Informational [Page 11]

File diff suppressed because it is too large Load diff

File diff suppressed because it is too large Load diff

File diff suppressed because it is too large Load diff

View file

@ -1,899 +0,0 @@
Internet Engineering Task Force (IETF) D. M'Raihi
Request for Comments: 6238 Verisign, Inc.
Category: Informational S. Machani
ISSN: 2070-1721 Diversinet Corp.
M. Pei
Symantec
J. Rydell
Portwise, Inc.
May 2011
TOTP: Time-Based One-Time Password Algorithm
Abstract
This document describes an extension of the One-Time Password (OTP)
algorithm, namely the HMAC-based One-Time Password (HOTP) algorithm,
as defined in RFC 4226, to support the time-based moving factor. The
HOTP algorithm specifies an event-based OTP algorithm, where the
moving factor is an event counter. The present work bases the moving
factor on a time value. A time-based variant of the OTP algorithm
provides short-lived OTP values, which are desirable for enhanced
security.
The proposed algorithm can be used across a wide range of network
applications, from remote Virtual Private Network (VPN) access and
Wi-Fi network logon to transaction-oriented Web applications. The
authors believe that a common and shared algorithm will facilitate
adoption of two-factor authentication on the Internet by enabling
interoperability across commercial and open-source implementations.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6238.
M'Raihi, et al. Informational [Page 1]
RFC 6238 HOTPTimeBased May 2011
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................2
1.1. Scope ......................................................2
1.2. Background .................................................3
2. Notation and Terminology ........................................3
3. Algorithm Requirements ..........................................3
4. TOTP Algorithm ..................................................4
4.1. Notations ..................................................4
4.2. Description ................................................4
5. Security Considerations .........................................5
5.1. General ....................................................5
5.2. Validation and Time-Step Size ..............................6
6. Resynchronization ...............................................7
7. Acknowledgements ................................................7
8. References ......................................................8
8.1. Normative References .......................................8
8.2. Informative References .....................................8
Appendix A. TOTP Algorithm: Reference Implementation ...............9
Appendix B. Test Vectors ..........................................14
1. Introduction
1.1. Scope
This document describes an extension of the One-Time Password (OTP)
algorithm, namely the HMAC-based One-Time Password (HOTP) algorithm,
as defined in [RFC4226], to support the time-based moving factor.
M'Raihi, et al. Informational [Page 2]
RFC 6238 HOTPTimeBased May 2011
1.2. Background
As defined in [RFC4226], the HOTP algorithm is based on the
HMAC-SHA-1 algorithm (as specified in [RFC2104]) and applied to an
increasing counter value representing the message in the HMAC
computation.
Basically, the output of the HMAC-SHA-1 calculation is truncated to
obtain user-friendly values:
HOTP(K,C) = Truncate(HMAC-SHA-1(K,C))
where Truncate represents the function that can convert an HMAC-SHA-1
value into an HOTP value. K and C represent the shared secret and
counter value; see [RFC4226] for detailed definitions.
TOTP is the time-based variant of this algorithm, where a value T,
derived from a time reference and a time step, replaces the counter C
in the HOTP computation.
TOTP implementations MAY use HMAC-SHA-256 or HMAC-SHA-512 functions,
based on SHA-256 or SHA-512 [SHA2] hash functions, instead of the
HMAC-SHA-1 function that has been specified for the HOTP computation
in [RFC4226].
2. Notation and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
3. Algorithm Requirements
This section summarizes the requirements taken into account for
designing the TOTP algorithm.
R1: The prover (e.g., token, soft token) and verifier (authentication
or validation server) MUST know or be able to derive the current
Unix time (i.e., the number of seconds elapsed since midnight UTC
of January 1, 1970) for OTP generation. See [UT] for a more
detailed definition of the commonly known "Unix time". The
precision of the time used by the prover affects how often the
clock synchronization should be done; see Section 6.
R2: The prover and verifier MUST either share the same secret or the
knowledge of a secret transformation to generate a shared secret.
R3: The algorithm MUST use HOTP [RFC4226] as a key building block.
M'Raihi, et al. Informational [Page 3]
RFC 6238 HOTPTimeBased May 2011
R4: The prover and verifier MUST use the same time-step value X.
R5: There MUST be a unique secret (key) for each prover.
R6: The keys SHOULD be randomly generated or derived using key
derivation algorithms.
R7: The keys MAY be stored in a tamper-resistant device and SHOULD be
protected against unauthorized access and usage.
4. TOTP Algorithm
This variant of the HOTP algorithm specifies the calculation of a
one-time password value, based on a representation of the counter as
a time factor.
4.1. Notations
o X represents the time step in seconds (default value X =
30 seconds) and is a system parameter.
o T0 is the Unix time to start counting time steps (default value is
0, i.e., the Unix epoch) and is also a system parameter.
4.2. Description
Basically, we define TOTP as TOTP = HOTP(K, T), where T is an integer
and represents the number of time steps between the initial counter
time T0 and the current Unix time.
More specifically, T = (Current Unix time - T0) / X, where the
default floor function is used in the computation.
For example, with T0 = 0 and Time Step X = 30, T = 1 if the current
Unix time is 59 seconds, and T = 2 if the current Unix time is
60 seconds.
The implementation of this algorithm MUST support a time value T
larger than a 32-bit integer when it is beyond the year 2038. The
value of the system parameters X and T0 are pre-established during
the provisioning process and communicated between a prover and
verifier as part of the provisioning step. The provisioning flow is
out of scope of this document; refer to [RFC6030] for such
provisioning container specifications.
M'Raihi, et al. Informational [Page 4]
RFC 6238 HOTPTimeBased May 2011
5. Security Considerations
5.1. General
The security and strength of this algorithm depend on the properties
of the underlying building block HOTP, which is a construction based
on HMAC [RFC2104] using SHA-1 as the hash function.
The conclusion of the security analysis detailed in [RFC4226] is
that, for all practical purposes, the outputs of the dynamic
truncation on distinct inputs are uniformly and independently
distributed strings.
The analysis demonstrates that the best possible attack against the
HOTP function is the brute force attack.
As indicated in the algorithm requirement section, keys SHOULD be
chosen at random or using a cryptographically strong pseudorandom
generator properly seeded with a random value.
Keys SHOULD be of the length of the HMAC output to facilitate
interoperability.
We RECOMMEND following the recommendations in [RFC4086] for all
pseudorandom and random number generations. The pseudorandom numbers
used for generating the keys SHOULD successfully pass the randomness
test specified in [CN], or a similar well-recognized test.
All the communications SHOULD take place over a secure channel, e.g.,
Secure Socket Layer/Transport Layer Security (SSL/TLS) [RFC5246] or
IPsec connections [RFC4301].
We also RECOMMEND storing the keys securely in the validation system,
and, more specifically, encrypting them using tamper-resistant
hardware encryption and exposing them only when required: for
example, the key is decrypted when needed to verify an OTP value, and
re-encrypted immediately to limit exposure in the RAM to a short
period of time.
The key store MUST be in a secure area, to avoid, as much as
possible, direct attack on the validation system and secrets
database. Particularly, access to the key material should be limited
to programs and processes required by the validation system only.
M'Raihi, et al. Informational [Page 5]
RFC 6238 HOTPTimeBased May 2011
5.2. Validation and Time-Step Size
An OTP generated within the same time step will be the same. When an
OTP is received at a validation system, it doesn't know a client's
exact timestamp when an OTP was generated. The validation system may
typically use the timestamp when an OTP is received for OTP
comparison. Due to network latency, the gap (as measured by T, that
is, the number of time steps since T0) between the time that the OTP
was generated and the time that the OTP arrives at the receiving
system may be large. The receiving time at the validation system and
the actual OTP generation may not fall within the same time-step
window that produced the same OTP. When an OTP is generated at the
end of a time-step window, the receiving time most likely falls into
the next time-step window. A validation system SHOULD typically set