Question: How does Novell's Packet Signature work and how much security does it provide my network communications?

  • 10024712
  • 1.0.49063836.2492062
  • 11-Jan-2000
  • 09-Oct-2002


Question: How does Novell's Packet Signature work and how much security does it provide my network communications?


Novell NetWare


The Novell Packet Signature is designed to prevent a hacker from being to take control of an existing session/connection to a server The best way to explain it is to provide an example:

The Novell admin is logged in to FS1 using connection number 73 and currently is on sequence number 52. A hacker manages to gain physical access to the network and send packets to FS1 using the correct connection number, sequence number, and other connection-oriented information. The hacker then sends a request to the server to create a new NDS user and then makes a request to make the new user security equivalent to the NDS admin user. The server will honor any valid request that it receives (valid meaning that the right connection number, sequence number, and other connection-oriented information is the same as when the connection was originally established). The hacker now has a separate valid NDS account that they can access the network through.

If packet signing were being required for the connection, the hacker would have to be able to accurately calculate what the next packet signature would be on the packet (this changes for each sequence number). Short of having the complete Packet Signature algorithm, this would be extremely difficult to do. Implementing Packet Signing effectively prevents hackers from being able to attempt to take control of a session/connection. It does not reduce the security risk for other types of attacks.

Technical explanation of Packet Signing:
At connection the client and server determine a session master key. Every NCP packet sent to the server will have the last 8 bytes of the session master key at the end of the packet. The session master key is recalculated for each new packet sequence number (which is basically any new NCP request) and is a hash from the packet data content, the previous 16 byte server session master key, and an encryption superkey. It is extremely difficult for a hacker to accurately predict what the next session master key will be for the following reasons;

1. The session master key is a hash and the encryption superkey makes hash of the new session master key non-reversible. In essence it makes it impossible for a hacker to know what the current session master key is or what the next one will be because the 8 byte signature he can see in a packet cannot be reverse-hashed into the encryption superkey and the 16 byte session superkey. It is essentially impossible to take the output data and properly predict what it was before or the algorithm used to convert it.

2. The number of factors that go into each new session master key greatly increases the level of complexity for trying to reverse-engineer.

While technically there is no such thing as impervious computer security, the Packet Signature greatly increases the security of the network and makes it much more difficult for a hacker to take control of an existing connection to a server. As previously noted, it does not reduce the risk of a security breach for other types of security attacks such as a hacker discovering a poorly-chosen admin password (i.e. part of their name, a family name, a combination of their birth or marriage year, etc...). The best security defense is physically preventing a hacker from ever having a chance to access your network. However in the globally networked world, Packet Signing can greatly increase network security once the hacker has gained physical access to the network.