Username based authentication and key generation
An apparatus and a method for an authentication protocol. A client generates a server unique identifier of a server prior to communicating with the server. An encrypted password generator module of the client calculates an encrypted password based on the server unique identifier, a username, and an unencrypted password. A communication request generator module of the client generates and sends a communication request to the server. The communication request includes a username, a client random string, a client timestamp, and a client MAC value. The client MAC value is computed over the username, the client random string, and the client timestamp, using the encrypted password as an encryption key.
1. A method comprising:
generating a server identifier for a server prior to communicating with the server;
calculating an encrypted password based on the server identifier, a username, and an unencrypted password, wherein the encrypted password comprises a hash value of the server identifier, the username, and the unencrypted password;
sending, by a processing device, a communication request to the server, the communication request comprising a username, a client random string, a client timestamp, and a client message authentication code (MAC) value, the client MAC value computed over the username, the client random string, and the client timestamp, using the encrypted password as a key for the client MAC value;
receiving a response to the communication request from the server, the response comprising the client random string, a server random string, a server timestamp, and a server MAC value over the client random string, the server random string, and the server timestamp using the encrypted password as a key for the server MAC value; and
generating a shared secret by calculating a shared secret MAC value of the client random string and the server random string using the encrypted password as a key for the shared secret MAC value.
2. The method of claim 1 wherein generating the server identifier comprises hashing the server's domain name system (DNS), network information service (NIS), or windows internet name service (WINS) name.
3. The method of claim 1 wherein calculating the encrypted password further comprises
performing an iterative hash of the username and the server identifier for a predetermined number of times.
4. The method of claim 3 further comprising
calculating an iterative MAC value of the result of the iterative hash using the unencrypted password as a key for the iterative MAC value.
5. The method of claim 3 further comprising
calculating an iterative MAC value of the result of the iterative hash using the result of the iterative hash as a key for the iterative MAC value and the password as a message for the iterative MAC value.
6. The method of claim 3 further comprising
calculating an iterative MAC value of the result of the iterative hash using an empty string as an initial message and alternating between using a password and using a hashed username, as a message.
7. The method of claim 1 further comprising:
validating a server timestamp;
calculating a computed MAC value over the client random string and the server random string; and
comparing the computed MAC value with the server MAC value.
8. The method of claim 1 , wherein the server identifier comprises a unique identifier.
9. A non-transitory computer-readable storage medium, having instructions stored therein, which when executed by a processor, cause the processor to:
generate a server identifier for a server prior to communicating with the server;
calculate an encrypted password based on the server identifier, a username, and an unencrypted password, wherein the encrypted password comprises a hash value of the server identifier, the username, and the unencrypted password;
send a communication request to the server, the communication request comprising a username, a client random string, a client timestamp, and a client message authentication code (MAC) value, the client MAC value computed over the username, the client random string, and the client timestamp, using the encrypted password as a key for the client MAC value;
receive a response to the communication request from the server, the response comprising the client random string, a server random string, a server timestamp, and a server MAC value over the client random string, the server random string, and the server timestamp using the encrypted password as a key for the server MAC value; and
generate a shared secret by calculating a shared secret MAC value of the client random string and the server random string using the encrypted password as a key for the shared secret MAC value.
10. The non-transitory computer readable storage medium of claim 9 wherein the processor further to hash the server's domain name system (DNS), network information service (NIS), or windows internet name service (WINS) name to generate the server identifier.
11. The non-transitory computer readable storage medium of claim 9 wherein the processor further to
perform an iterative hash of the username and the server identifier for a predetermined number of times to calculate the encrypted password.
12. The non-transitory computer readable storage medium of claim 11 wherein the processor further to
calculate an iterative MAC value of the result of the iterative hash using the unencrypted password as a key for the iterative MAC value.
13. The non-transitory computer readable storage medium of claim 11 wherein the processor further to
calculate an iterative MAC value of the result of the iterative hash using the result of the iterative hash as a key of the iterative MAC value and the passwords as a message.
14. The non-transitory computer readable storage medium of claim 11 wherein the processor further to
calculate an iterative MAC value of the result of the iterative hash using an empty string as an initial message and alternating between using a password and using a hashed username, as a message.
15. The non-transitory computer readable storage medium of claim 9 wherein the processor further to
validate a server timestamp;
calculate a computed MAC value over the client random string and the server random string; and
compare a computed MAC value with the server MAC value.
16. The non-transitory computer-readable storage medium of claim 9 , wherein the server identifier comprises a unique identifier.
17. A client device comprising:
a memory device; and
a processor operatively coupled to the memory device, the processor to execute:
a server identifier generator module operable to generate a server identifier for a server prior to communicating with the server;
an encrypted password generator module coupled to the server identifier generator module, the encrypted password generator module operable to calculate an encrypted password based on the server identifier, a username, and an unencrypted password, wherein the encrypted password comprises a hash value of the server identifier, the username, and the unencrypted password;
a communication request generator module coupled to the encrypted password generator module, the encrypted password generator module operable to send a communication request to the server, the communication request comprising a username, a client random string, a client timestamp, and a client message authentication code (MAC) value, the client MAC value computed over the username, the client random string, and the client timestamp, using the encrypted password as a key of the client MAC value;
a server timestamp validator operable to receive a response to the communication request from the server, the response comprising the client random string, a server random string, a server timestamp, and a server MAC value over the client random string, the server random string, and the server timestamp using the encrypted password as a key of the server MAC value; and
a shared secret generator module operable to generate a shared secret by calculating a shared secret MAC value of the client random string and the server random string using the encrypted password as a key of the shared secret MAC value.
18. The client device of claim 17 wherein the server identifier generator module is operable to generate the server identifier by hashing the server's domain name system (DNS), network information service (NIS), or windows internet name service (WINS) name.
19. The client device of claim 17 wherein the encrypted password generator module is further operable to perform an iterative hash of the username and the server identifier for a predetermined number of times.
20. The client device of claim 19 wherein the encrypted password generator module is further operable to calculate an iterative MAC value of the result of the iterative hash using the unencrypted password as a key of the iterative MAC value.
21. The client device of claim 19 wherein the encrypted password generator module is further operable to calculate an iterative MAC value of the result of the iterative hash using the result of the iterative hash as a key of the iterative MAC value and the password as a message.
22. The client device of claim 19 wherein the encrypted password generator module is further operable to calculate an iterative MAC value of the result of the iterative hash using an empty string as an initial message and alternating between using a password and using a hashed username, as a message.
23. The client device of claim 19 wherein the server timestamp validator is further operable to validate the server timestamp, and wherein the processor of the client device is to further execute
a MAC module coupled to the server timestamp validator and operable to calculate a computed MAC value over the client random string and the server random string, and operable to compare the computed MAC value with the server MAC value.
24. The client device of claim 17 , wherein the server identifier comprises a unique identifier.