authenticate against SHA2 hash in EAP-MSCHAPv2

[Volodymyr Litovka]

Hi again, colleagues,

please correct me, if I'm wrong.

When using mschapv2, user sends his password in cleartext and FreeRadius 
compares it to one stored in, e.g., "users":

1) if Cleartext-Password used, then just compare strings
2) if NT-Password used, then create NTLM hash from supplied password and 
compare hashes
3) otherwise reject request (no other allowed methods)

the issue with this is the following - there are many systems with tens 
of users which use "users" since there is no sense to supply LDAP/etc 
additionally to FreeRadius (not a big scale). But if, using any way, 
"users" file will leak outside, then we can assume open access to system 
- cleartext is cleartext, while services like 
https://hashkiller.co.uk/ntlm-decrypter.aspx with databases of 
previously stolen hashes (thank to always vulnerable Windows) can be 
used to search for the specific hash and, thus, to get corresponding 
password.

Why not to add 3rd, 4th and next *internal* checks against records in 
"users" if we know which kind of hash used there? I mean

3) if SHA2_256-Password used, then create SHA256 hash and compare hashes
4) if SHA2_512-Password used, then create SHA512 hash and compare hashes
...
n) reject request as there are no other methods

while all these "SHA2_xxx" methods can be aliases to SHA2 when used with 
EAP-GTC or other methods. So, (a) this is internal deal of Freeradius 
which don't break any standards and (b) will prevent password reverse 
engineering in case of configuration leakage.

Thank you.

On 2/28/18 12:55 PM, Arran Cudbard-Bell wrote:
>
>> On Feb 28, 2018, at 4:34 PM, Volodymyr Litovka <doka.ua at gmx.com> wrote:
>>
>> Hi colleagues,
>>
>> I'm pretty new in FreeRadius and looks missing something that will allow me to authenticate MSCHAP users agains stored SHA256 hashes.
>>
> See magic bingo card: http://deployingradius.com/documents/protocols/compatibility.html
>
> Same applies to SHA256 as it does SHA1.
>
> -Arran
>
>
> Arran Cudbard-Bell <a.cudbardb at freeradius.org>
> FreeRADIUS Development Team
>
> FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

-- 
Volodymyr Litovka
   "Vision without Execution is Hallucination." -- Thomas Edison