Re: [Cfrg] AAA versus A+AA was -> Re: how can CFRG improve cryptography in the Internet?

[Paul Lambert <[e-mail]>]

On 2/12/14, 9:36 PM, "Peter Gutmann" <[e-mail]> wrote:

>Paul Lambert <[e-mail]> writes:
>
>>I continue to wonder why we continue to build new systems on symmetric
>>key 
>>based authentication techniques.  Symmetric keys are the main reason we
>>have 
>>a triple-A (AAA -> authentication, authorization and accounting) versus
>>splitting up the functions and enabling a A+AA architecture where the
>>authentication could be performed directly by the directly participating
>>parties.
>
>The reason why it's a bad idea to do that with public-key is that, at
>least in 
>the form of PKI, you start off doing the first A, and then you redo the
>first 
>A, and then you make more changes to the first A, and then you release
>first-A 
>version 3, and then you do some more of the first A, and 25-30 years
>later 
>you're still redoing the first A without ever getting around to the other
>two. 
>Symmetric-key RADIUS et al at least got around to doing all three right
>from 
>the start.

Yes Š good point, RADIUS could be relatively easily installed and then
worked well enough.

So the root of all security problems in the Internet is X.509  :-)

We have architected security based on a subtly flawed overly complex
authentication architecture.


Paul



>
>Peter.