viathinksoft-std-0004-mcf1.nroff

.\" This document was created using "Nroff Internet Draft Editor"
.\" Note that a hotfix is required to use this program after 1st January 2020:
.\" https://misc.daniel-marschall.de/patches/nroffedit/
.\"
.\" Alternative, you can compile this document on Linux, using the following command:
.\"        nroff -T ascii -ms viathinksoft-std-0004-mcf1.nroff | ./fix_formfeed.pl > viathinksoft-std-0004-mcf1.txt
.\" Note that "-ms" only works if the package "groff" is installed.
.\" fix.pl needs to be executed to replace FORMFEED.
.\" Note that the Linux command does not auto-generate the Table of Contents, since this is a NroffEdit feature!
.\"
.\" Note about section titles: According to RFC7322, the section capitalization should be Chicago Manual of Style
.\" Use this tool: https://titlecaseconverter.com/ 
.\"
.\" These values are required for my Debian Linux system (nroff) so that it outputs the same lines like NroffEdit
.pl 95n
.nr HM 6n
.nr FM 8n
.\" Page length
.\".pl 10.0i
.\" Page offset
.po 0
.\" Length of line
.ll 7.2i
.\" Length of title
.lt 7.2i
.\" Line Length (ms macro)
.nr LL 7.2i
.\" Title line length
.nr LT 7.2i
.\" Left footer text
.ds LF Marschall
.\" Right footer text. "FORMFEED" will be replaced by a post-processing script.
.ds RF FORMFEED[Page %]
.\" Left header text
.ds LH VTS/WF STD. 4
.\" Right header text
.ds RH 3 September 2024
.\" Center header text
.ds CH ViaThinkSoft MCF1
.\" Center footer text
.ds CF 
.\" Hyphenation mode set to 0
.hy 0
.\" Disable hyphenation
.nh
.\" Adjust text left
.ad l
.\" Set indent (can be overridden for a single line using .ti = temporary indent)
.in 0

.nf
.tl 'VIATHINKSOFT/WEBFAN''D. Marschall'
.tl 'SPECIFICATION No. 4''ViaThinkSoft'
.tl 'First Draft: 2023''3 September 2024'
.fi

.\" Note. The ".tl" directive is used to generate the leading header 
.\" in Internet drafts. The information specified after ".tl" provides
.\" left, center and right components of a line separated by the ' character
.\" in the following manner:
.\" 
.\"  .tl '<left component>'<center component>'<right component>'
.\"
.\" Only the left and right components are used in Internet-draft headers
.\" This and other comments in this template can safely be deleted.

.ce 3
=== ViaThinkSoft Modular Crypt Format 1.0 (MCF1) ===
.fi
.in 3

.ti 0
Abstract

This document describes how the standards for ViaThinkSoft and Webfan are defined, written, and published.

.ti 0
Identification of this Document

.in 3
.nf
Revision:  2024-09-03
State:     In Force
Filename:  viathinksoft-std-0004-mcf1.txt
URN:       urn:x-viathinksoft:std:0004:2024-09-03
OID:       1.3.6.1.4.1.37476.3.0.1.1
           { iso(1) identified-organization(3) dod(6) internet(1)
             private(4) enterprise(1) 37476 specifications(3)
             misc(0) modular-crypt-format(1) vts-crypt-v1(1) }
WEID:      weid:pen:SX0-3-0-1-1-5
IETF/RFC:  (None)
.fi

.ti 0
Attachments

Reference implementation in PHP:
https://github.com/danielmarschall/php_utils/blob/master/\\
vts_crypt.inc.php

.ti 0
Copyright Notice

Copyright (c) 2023-2024 ViaThinkSoft and the persons identified as the
document authors.  All rights reserved.

Licensed under the terms of the Apache 2.0 License.
.br
.\" These values are required for my Debian Linux system (nroff) so that it outputs the same lines like NroffEdit
.nr HM 8n
.nr FM 8n
.bp
.pl 96n
.\" \# TD4  -- Set TOC depth by altering this value (TD5 = depth 5)
.\" \# TOC  -- Beginning of auto updated Table of Contents
.in 0
Table of Contents

.nf
   1  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . .  3
     1.1  Terminology . . . . . . . . . . . . . . . . . . . . . . . .  3
   2  MCF Structure . . . . . . . . . . . . . . . . . . . . . . . . .  3
   3  Test Vectors  . . . . . . . . . . . . . . . . . . . . . . . . .  4
   4  Security Considerations . . . . . . . . . . . . . . . . . . . .  4
   5  RA Considerations . . . . . . . . . . . . . . . . . . . . . . .  5
   6  References  . . . . . . . . . . . . . . . . . . . . . . . . . .  5
     6.1  Normative References  . . . . . . . . . . . . . . . . . . .  5
     6.2  Informative References  . . . . . . . . . . . . . . . . . .  5
   Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . .  5
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . .  5
.fi
.in 3

.\" \# ETC -- End of auto updated Table of Contents

.bp
.ti 0
1  Introduction

ViaThinkSoft Modular Crypt Format 1.0 performs a simple hash or HMAC operation and stores the result in a Modular Crypt Format compatible string.  No key derivation function or iterations are performed.

ViaThinkSoft MCF was invented to allow old passwords (e.g. MD5 with salt) to be easily converted to a MCF notation ($...$...$) so that these old passwords can be stored
in the same data structure as newer crypt passwords, until they get upgraded to a newer
hash.  But it can also be used to encapsulate modern hash algorithms like SHA3/512 into
a MCF format, so that they can be stored together with other MCF passwords such as bcrypt.

Another innovation is to use Object Identifiers (OIDs) as MCF algorithm identifier.
Algorithm identifiers such as $1$, $2$, ... are nice to remember and short, but
can quickly lead to conflicts, and soon you run out of short identifiers.

.ti 0
1.1  Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP\014 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

.ti 0
2  MCF Structure

Format of VTS MCF1:

.nf
$<id>$<params>$<salt>$<hash>
.fi

<id> is 1.3.6.1.4.1.37476.3.0.1.1

<params> is a=<algo>,m=<mode>[,i=<iterations>]

where <algo> is any valid hash algorithm (name scheme of PHP hash_algos() preferred), e.g.
.nf
- sha3-512
- sha3-384
- sha3-256
- sha3-224
- sha512
- sha512/256
- sha512/224
- sha384
- sha256
- sha224
- sha1
- md5
.fi

Not possible with MCF1 are these hashes (because they have a special salt-handling and output their own crypt format):
.nf
- bcrypt [Standardized crypt identifier 2, 2a, 2x, 2y]
- argon2i [Crypt identifier argon2i, not standardized]
- argon2id [Crypt identifier argon2i, not standardized]
.fi

Valid <mode> parameters:
.nf
- sp = salt + password
- ps = password + salt
- sps = salt + password + salt
- shp = salt + Hash(password)
- hps = Hash(password) + salt
- shps = salt + Hash(password) + salt
- hmac = HMAC (salt is the key)
- pbkdf2 = PBKDF2-HMAC
.fi

<iterations> can be omitted if 0.  It is required for mode m=pbkdf2.  For sp/ps/sps/shp/hps/shps/hmac, it is optional.

Like most Crypt-hashes, <salt> and <hash> are Radix64 coded
without padding and with alphabet
'./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'.

.ti 0
3  Test Vectors

Input:      Hello World
.br
Hash:       $1.3.6.1.4.1.37476.3.0.1.1$a=sha3-256,m=sp$$2Ud0hUTh//swVxoilAltWQ/9LQ189eZcdJ/hA5HkV/C
.br
Algorithm:  SHA3-256
.br
Mode:       sp (Salt || Password)
.br
Salt:       None

Input:      Hello World
.br
Hash:       $1.3.6.1.4.1.37476.3.0.1.1$a=sha3-256,m=sp$CAT/9cvgCuS$dqNf5hJf0p09lYx.9rvI/c96swTz58tGhipuhobl8Ke
.br
Algorithm:  SHA3-256
.br
Mode:       sp (Salt || Password)
.br
Salt:       8 Bytes
.br
.br

.ti 0
4  Security Considerations

Hash values play a crucial role in various security contexts, such as password verification.  For detailed guidance on securely managing hashes, please consult the relevant literature or documentation.
.bp
.ti 0
5  RA Considerations

.nf
OID:  1.3.6.1.4.1.37476.3.0.1.1
ASN1: { iso(1) identified-organization(3) dod(6) internet(1)
private(4) enterprise(1) 37476 specifications(3)
misc(0) modular-crypt-format(1) vts-crypt-v1(1) }
IRI:  /.../Specifications/Misc/ModularCryptFormat/VtsCryptV1
WEID: weid:pen:SX0-3-0-1-1-5
.fi


.ti 0
6  References

.ti 0
6.1  Normative References
.in 14

.\" https://www.rfc-editor.org/refs/ref2119.txt
.ti 3
[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP\014, RFC\02119, DOI\010.17487/RFC2119, March\01997,
.br
<https://www.rfc-editor.org/info/rfc2119>.

.in 3
.ti 0
6.2  Informative References
.in 14

.ti 3
None

.in 3
.ti 0
Acknowledgements
.in 3

I would like to thank Melanie Wehowski for her long time support in OIDplus and WEID projects.

This document was written in Nroff Internet Draft Editor by 3xA Security.
.br
https://aaa-sec.com/nroffedit/
.br
https://misc.daniel-marschall.de/patches/nroffedit/ ("year 2020" patch)

.ti 0
Authors' Addresses
.in 3

.nf
Daniel Marschall
Postfach 11 53
69243 Bammental
Germany

Email: daniel-marschall@viathinksoft.de
URI:   https://www.viathinksoft.com/
.fi