Changes between Version 3 and Version 4 of SWEET32

Timestamp:

08/24/16 22:05:44 (8 years ago)

Author:

Steffan Karger

Comment:

--

SWEET32

@@ -38 +38 @@
 config to renegatiate after every 64 megabytes.
 
-Note that if you're using two-factor authentication, or username-password
-authentication, this might require used to re-enter their 2FA token or
-usernamne and password.  To avoid this, do not use --auth-nocache, and enable
-<insert-correct-name> on the server side to ask for 2FA once per session only.
+Note that if you're using two-factor authentication, or username-password authentication, this might require users to re-enter their 2FA token or usernamne and password.  To avoid this, do not use {{{--auth-nocache}}}, and use the {{{auth-token}}} option (see below) in the client-connect and auth-user-pass-verify scripts on the server side to ask for 2FA once per session only.
 
-<some text on the single-2FA-per-session option>
+The (undocumented) {{{auth-token}}} option can be pushed by a client-connect script (running on the server) to instruct the connecting client to return this token as the password during the next authentication.  The auth-user-pass-verify script (running on the server) should accept this token during the next authentication sessions, until the token expires.
+
+The following client-connect and auth-user-pass-verify scripts illustrate how these options can be used.  Note that these scripts are examples for auth-token usage only, and should be adapted to your own needs before using them.  These scripts should not be used as-is!
+
+client-connect:
+{{{
+#!/usr/bin/env python
+
+import base64
+import hmac
+import os
+import sys
+import time
+
+username = os.environ['username']
+
+# Create an authentication 'cookie' that binds to the current user and time
+ts = time.time()
+to_auth = str(ts) + ":" + username
+
+h = hmac.new('mysecret')
+h.update(to_auth)
+digest = base64.b64encode(h.digest())
+
+auth_token = "push \"auth-token " + str(ts) + ":" + digest + "\""
+
+print "Sending auth-token:", auth_token
+
+open(sys.argv[1], 'w').write(auth_token)
+}}}
+
+auth-user-pass-verify:
+{{{
+#!/usr/bin/env python
+
+import base64
+import hmac
+import os
+import time
+
+username = os.environ['username']
+password = os.environ['password']
+
+# Try password auth first
+if (password == "mysecretpassword"):
+    print "password OK"
+    exit(0)
+
+# Otherwise verify auth-token
+token = password.split(":")
+
+to_auth = token[0] + ":" + os.environ['username']
+
+h = hmac.new('mysecret')
+h.update(to_auth)
+digest = h.digest()
+
+# Exit with error if authentication fails
+if digest != base64.b64decode(token[1]):
+    print "Auth-token incorrect"
+    exit(1)
+
+# Exit with error if auth-token expired
+if time.time() - float(token[0]) > 60:
+    print "Auth-token expired"
+    exit(1)
+
+# All went well!
+exit(0)
+}}}
 
 == 3. Enable cipher negotiation (experimental!)