Telnet Authentication: SRP
Extracted elements (19)
If the modifier byte of the authentication-type-pair has bits set beyond AUTH_WHO_MASK or AUTH_HOW_MASK, both bytes are included in the session key hash. This ensures the authentication type pair was correctly negotiated while maintaining backward-compatibility with existing software.
SRP-SHA1 generates a 40-byte session key, allowing implementations to use different keys for incoming and outgoing traffic to increase encrypted session security. It is recommended that Telnet ENCRYPT take advantage of these longer session keys.
The server may offer multiple authentication options ordered by preference (e.g., SRP CLIENT|ONE_WAY|ENCRYPT_USING_TELOPT before SRP CLIENT|ONE_WAY) to allow fallback when the client does not support the preferred encryption mode.
When ENCRYPT_USING_TELOPT is specified, the two octets of the authentication-type-pair are appended to the session key K before the hash for the RESPONSE message M is computed. If no encryption flag is set, nothing is appended to K.
All large number data sent in PARAMS and EXP commands must be in network byte order (most significant byte first) with no padding.
Only AUTH_CLIENT_TO_SERVER mode is currently supported. Only AUTH_HOW_ONE_WAY authentication mode is currently defined; AUTH_HOW_MUTUAL is reserved for a future explicit mutual-authentication variant.
SRP is assigned authentication type code 5 in the Telnet Authentication framework. Suboption commands are AUTH (0), REJECT (1), ACCEPT (2), CHALLENGE (3), RESPONSE (4), EXP (8), and PARAMS (9).
The ACCEPT command (IAC SB AUTHENTICATION REPLY <auth-type-pair> ACCEPT <server's response> IAC SE) indicates successful authentication and includes the server's own proof of knowing the session key.
The AUTH command (IAC SB AUTHENTICATION IS <auth-type-pair> AUTH IAC SE) indicates the client has supplied the username and is ready to receive SRP field parameters. It must be sent after the IAC SB AUTHENTICATION NAME command.
The CHALLENGE command (IAC SB AUTHENTICATION REPLY <auth-type-pair> CHALLENGE <server's exponential residue> IAC SE) passes the server's exponential residue B, which is the sum g^x + g^b.
The EXP command (IAC SB AUTHENTICATION IS <auth-type-pair> EXP <client's exponential residue> IAC SE) passes the client's exponential residue A, computed against the exchanged parameters.
The PARAMS command (IAC SB AUTHENTICATION REPLY <auth-type-pair> PARAMS <modulus, generator, salt> IAC SE) passes the three SRP parameters n, g, and s from server to client, each preceded by a 16-bit network-byte-order length specifier.
The REJECT command (IAC SB AUTHENTICATION REPLY <auth-type-pair> REJECT <optional reason> IAC SE) indicates failed authentication; optional sub-option data is an ASCII text reason for rejection.
The RESPONSE command (IAC SB AUTHENTICATION IS <auth-type-pair> RESPONSE <response> IAC SE) provides server proof of client authenticity with a 160-bit (20-byte) response, corresponding to message M in the SRP protocol.
The authentication type SRP (value 5) and its associated suboption values are registered with IANA. Any new suboption values extending the protocol must be registered with IANA before use; IANA must not issue new values without documentation of their use.
Authentication mechanism negotiation occurs before any authentication, so neither party can verify the other's identity during negotiation. An intruder could attempt to negotiate use of a weak or compromised authentication system.
Since SRP relies on the security of the underlying public-key cryptosystem, the modulus n should be at least 1024 bits. Implementations should reject moduli shorter than 512 bits and must reject invalid moduli and generator parameters (non-safe-prime n or non-primitive g).
The SRP authentication exchange proceeds: client sends NAME then AUTH, server replies PARAMS, client sends EXP, server replies CHALLENGE, client sends RESPONSE, server replies ACCEPT or REJECT. The CHALLENGE message may be computed before but not sent before EXP.
In the PARAMS command, each of the three parameters (n, g, s) is preceded by a 16-bit (two-byte) length specifier in network byte order. EXP, CHALLENGE, RESPONSE, and ACCEPT data have no length prefix.