AppleShare Password Authentication & Security

By: Richard Glaser - Revised: 2006-06-07 devin

A note about authentication from Leland Wallace
The algorithms for all of the AppleShare Authentication methods are public. I don't see this as a problem. The security of the method is in the math, not in some secret algorithm. The AppleShare password encryption method he mentions, is probably the method for storing the passwords in the Users & Groups data file on the Server, which is only a problem if you send your attacker that file (AppleShare won't share the System folder on the server). Or, if the attacker has physical access to your server, then he/she could copy the Users & Groups data file; of course your server should ALWAYS be in a secure location.

The most widely used (at this time) auth method is 2 Way random (introduced in 1989) which sends two 8 byte DES encrypted random numbers over the network. From a computational standpoint the algorithm is exactly as strong as 56-bit DES. It is however vulnerable to an off-line password guessing attack (similar to running crack against a unix passwd file), and it has a password length limit of 8 characters.

We have developed a new authentication method that addresses the weaknesses of 2 Way randnum, called DHX. DHX uses Diffie-Hellman key exchange to create a 128 bit session key and then sends a 64 character password to the server encrypted with CAST 128. It's strength is approximately equivalent to 128-bit SSL. (iDisk uses DHX)

So I suppose the answer to the question is, we've been doing 56-bit encryption since 1989, and we're in the process of moving to 128 bit encryption. Both are reasonably safe on the Internet, and infinitely safer than protocols like FTP, POP or HTTP which send passwords in the clear over the network.