Key or No Key?

[greatbarrier86]

Hello,

I just noticed that the MSRC plugin does not require a key in order to work properly as it will just hash the password. Which way is recommended or are they equally as secure?

Thanks,
Jason

[redge]

If you don't have a key file the following happens:

The plugins generate a 128 Bit random IV (Initial Vector) and exchange them. The password is hashed using 128 MD5 hash. A random 128 Bit SALT is generated and added to the key.

The 128 Bit hashed/SALTed password and the IV are used to start the encryption stream. This is effectivly a 128 bit session key that changes with each connection. No real need for a key file anymore. The only way this process could be improved is if UltraVNC supported more than 8 characters for the password.

If you DO have a key, the 128 Bit key is used instead of the password, but all of the above still happen.

That is the BIG improvement of 1.2.0 over 1.1.8.

Sean

related
[topic=6708][/topic]

[redge]

Is connecting via KEY more secure?

Short answer, a little, because the key has more bits than the password can.

Key = 128 Bits
Password = 64 Bits

Both are hashed into a 128 Bit session key.

Sean

what's the purpose of the key then?

2 purposes


* for travelling and limited access to registry or read only.
vncviewer+rc4.key+msrc4plugin_noreg.dsm on USB storage

* for SingleClick (SC) cannot use password not existing due reverse connection and need the key.
otherwise, without rc4.key msrc4plugin ask password and authentication always fail.

[scovel]

Also,

If you have a key, any intruder has to have 2 pieces of information, your password AND your key, in order to break into your computer.

Sean

[greatbarrier86]

Ah...this is good to know! Thanks for the input!