Can you spot a vulnerability in my authentication protocol?

Question

Some time ago we needed a solution for Single Sign On authentication between multiple web services. At least at that time we considered OpenID protocol too complicated and we were not convinced about the Ruby on Rails plugins for it. Therefore we designed a protocol of our own instead of implementing an OpenID provider and OpenID consumers.

I have two questions:

1. Was it a bad thing not to create our own OpenID provider and setup our OpenID consumers accept only it? Public login or registration are not allowed and we wanted to keep authentication simple.

2. Can you spot a crucial error or a vulnerability in the following design?

If you as a commune can approve this design, I will consider extracting this code into a Ruby on Rails plugin.

Please look at the flowchart and sequence diagram.

Details:

Authentication Provider ("AP"):

• Central service which holds all data about the users.
• Only one "AP" exists in this setup.
• It could be possible to have multiple "AP"s, but that should not be relevant in this context.
• "AP" knows each "S" beforehand.

Authentication Client (Service "S"):

• There exists several internal and external web services.
• Each service knows "AP" and its public key beforehand.

Actor ("A"):

• The end user who authenticates herself with AP by a username and password
• May request directly any URI of "S" or "AP" prior to her login

Connections between "A", "S" and "AP" are secured by HTTPS.

Authentication logic described briefly:

These are a description for the graphical flowchart and sequence diagram which were linked at the top of this post.

1) Auth Provider "AP"

• "AP" makes a server-to-server HTTP POST request to "S" to get a nonce.
• "AP" generates an authentication token.
• Authentication token is an XML entity which includes:
  • an expiration date (2 minutes from now),
  • the previously requested nonce (to prevent replay),
  • identifying name of "S" (token for Service_1 is not good for Service_2),
  • information about the end user.
• Authentication token is encrypted with AES256 and the encryption key and initialization vector are signed by AP's private RSA key.
• Resulting strings ("data", "key" and "iv") are first Base64 encoded and then URL encoded to allow them be delivered in the URL query string.
• End user "A" is HTTP-redirected to service "S" (HTTPS GET request).

2) Service "S"

• Receives authentication token in URL parameters from user agent.
• Decrypts authentication token with AP's pre-shared public key.
• Accepts one authentication token only once (token includes a nonce which is valid only once).
• Checks that identifying name in authentication token corresponds to service's name.
• Checks that authentication token is not expired.

Remarks:

It is not a problem if somebody else can also decrypt the authentication token, because it contains no confidential information about the user. However, it is crucial that nobody else than AP is able to generate a valid authentication token. Therefore the RSA key pair is involved.

RSA private key is used only for signing the token, because it cannot encrypt data which is longer than the actual key length. Therefore AES is used for encryption.

Since the authentication token is delivered as an HTTP GET request, it will be stored e.g. in Apache's log file. Using a disposable nonce and an expiration date should minimize the possibility of a replay attack. POST request would need an HTML page with a form which is submitted automatically by Javascript, which is why GET is used.

Service "S" generates a nonce only in a server-to-server API request. Therefore unauthenticated generation requests should not pose a DoS-vulnerability.

Answer 1

You're confusing authentication ("I am who I say I am") and authorization/access control ("I am allowed to access this"). You can just implement OAuth, and then query a server over HTTPS with "is this OAuth identity allowed to access me?". You don't have to worry about replay attacks, since you're using HTTPS.

"Security is hard, so I'll design my own."

Authentication token is encrypted with AES256 and the encryption key and initialization vector are signed by AP's private RSA key.

AES-256 and AES-192 have weak key schedules. But you're not using it for confidentiality; you're using it as some sort of "integrity" check. It doesn't work: Attacker gets a "signed" authentication token. Attacker recovers the key and IV. Attacker encrypts a different authentication token with the same key and IV, and uses the same "signature".

What's wrong with hashing it and signing the hash? Also note that if you're going to use custom signing, you need to be careful about padding (IIRC PKCS-whatever adds at least 11 bytes).

EDIT: And if you're using a cipher where you should be using a hash/MAC, you really shouldn't be designing a security protocol!

Answer 2

Here are a few quick thoughts about question 1:

• Designing a working security protocol is very hard, so on general principle I would favor using an existing one.

• However, I appreciate that OpenID might not have been very established at the time. Also OpenID is still relatively new and might not have all of its limitations figured out yet.

• Still, you'd be using OpenID in a restricted scenario where the big issue of OpenID (involvement of multiple actors) doesn't come into play. You'd only be using the “technical core” of OpenID, which is easier to understand.

• Your requirements and the overview of your protocol remind me of Kerberos. I'm also tempted to push towards LDAP + single sign on, but I don't know what concrete solutions exist for that.

• A point in favor of your protocol is that you've taken the time to describe it in detail. Just that puts you above than most self-made security protocol designers!