...
April 12 at Noon ET
+1-734-615-7474 PREFERRED
+1-866-411-0013
0195240#
Agenda: Updates to AIs
Action Items
- Michael to update the table to reflect LDAP (SSL/TLS), Kerberos and protected channels guidance by citing it once in the matrix and using footnotes where later applicable.
- ALL review the matrix with an eye to our two use cases highlighted in the scoping doc: AD as a verifier and AD as a provisioned copy of the credentials but not acting as the IdP's verifier.
- Brian will update 4.2.5.1.
- All - Do we want to compare Kerberos5 with MS AD Kerb?
- Jeff W will update 4.2.5.2
Cookbook Todo List
Add guidance about methods to prevent transient password exposure.
Notes
NASA Questions
The subgroup will be meeting with NASA on April 17th. What should be the focus of the conversation: Do they support LoA 2 or higher with AD with a password? What levels of Assurance do they support with AD? If so how? Show the Matrix.
Notes approved.
Action Item Updates
David's AM Abstract - InC AM process meant to address alternative ways of meeting the specific criterion of the IAP. Maybe this could be more of a general principle of how to review this, so one can't submit a general AM that covers multiple criteria. Need an AM proposal for the specific item, but we can introduce this notion of checking non-compliant behavior in a timely manner when we see it is found.
Michael's updates re: LDAP (SSL/TLS), Kerberos and protected channels - This information will be duplicated across the table. How should we track it in the table. document it? Add it one to the first cell and then refer to it with the footnote. Anyone turned off all the non-compliant ciphers? For PCI, Chicago has done this, but has not received complaints. AM might be RC4 128 bit encryption is as good as the approved algorithms. This would fall under industry standard, but isn't NIST/FIPS approved. Could be approved for a period of time or just for Bronze? M to update the table to reflect this approach for these topics.
Matrix
ALL - We need to review the matrix with an eye to our two use cases highlighted in the scoping doc: AD as a verifier and AD as a provisioned copy of the credentials but not acting as the IdP's verifier. Matrix
4.2.5.1 - Resist Replay Attack - Needs more details. NTLMv2 has time element that isn't included. More to the Kerberos statement. Resist Replay This is a passive listening attack where the bad guy is just replaying a hash or another credential as-is to access the target. This doesn't give you anything to make an identity assertion. Where does AD fit fits into IdMS and IdP is really important: If it acts as a verifier for the IdP . Ron says these aren't gaps. High level statement to apply to particular environment. Passive listening.
DOn't learn th epassowrd, just replyaing a hash or another cred that gets you to the target.
Review our Scoping.
Storing or using the same password in AD as in the verifier for the IdP, this applies.
or is storing the same password that the IdP verifier uses, then there are issues. Otherwise, it doesn't apply and there are no gaps.
AI - Brian will update this sectionBrian - flush out for the next call.
4.2.5.2 - Resist Eavesdropper Attack - Capture credential and use in replay. or Capture credential and decrypting it. Cux in MiM/easvesdropper aren't as important as the risk you're trying to mitigateThis active attack involves capturing the credential, decrypting it, and using it to gain access. Eavesdropping on one-time used token (Kerberos) is lower risk to than a multiple-use password.
Active act.
Kerberos by the use of tickets is not vulnerable to eavesdropper attack. AI - All - Do we want to compare Kerberos5 with MS AD Kerb?
Discussed the term impractical Impractical defined in 800-63: requires password that takes at least 2^80 cryptographic operations to crack it. 13 character password is 2^85.
would be good to compare Kerb5 with MS AD Kerb.
Kerb - pre-authn key exchange could be vunerable to eavesdropper - MS impement Kerb armoring in Windows 2012 and 2008.
Kerb - resist by definition of the protocol.
If using 2008, could increase the password length to mitigate.
Michael - SSL and TLS and Kerbos information in email and reference them into the right cells. AI - Jeff W. will update this section.