Re: [Ace] Offline operation of Resource Server

+1.

That is what we had also in mind with our EAP/AAA solution (for bootstrapping). In fact, although not in the context of IoT, UMU has been working in bootstrapping Kerberos with EAP/AAA authentication. We think some of the ideas could be still applicable here. As Josh mentioned we have running code.

Best Regards.

- Rafael Marin-Lopez, Fernando Pereniguez, Gabriel Lopez, and Alejandro
Perez-Mendez. Providing EAP-based Kerberos pre-authentication and
advanced authorization for network federations. Computer Standard &
Interfaces, 33(5):494-504, 2011.

- Alejandro Perez-Mendez, Fernando Pereniguez-Garcia, Rafael Marin-Lopez, and
Gabriel Lopez-Millan. Out-of-band federated authentication for Kerberos
based on PANA. Elsevier Computer Communications, 36(14):1527 1538, 2013.

El 14/07/2014, a las 13:44, Hannes Tschofenig <hannes.tschofenig@gmx.net> escribió:

> Interesting point, Josh.
> 
> On 07/14/2014 01:43 PM, Josh Howlett wrote:
>> A strict requirement for offline operation need not necessarily
>> exclude an AAA/EAP solution. It is perfectly possible, for example,
>> to use GSS EAP pre-authentication to obtain a Kerberos ticket from a
>> KDC. There is running code.
> 
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace

-------------------------------------------------------
Rafael Marin Lopez, PhD
Dept. Information and Communications Engineering (DIIC)
Faculty of Computer Science-University of Murcia
30100 Murcia - Spain
Telf: +34868888501 Fax: +34868884151 e-mail: rafa@um.es
-------------------------------------------------------