RE: I-D ACTION:draft-ietf-ipsec-isakmp-gss-auth-03.txt

["Waters, Stephen" <[e-mail]>]

Derrell,

I've taken a quick wonder through the GSS documents now. And I have a
questions:

A few weeks/months back, we were debating on the list how public-key could
be used with IKE without the need for PKI (CA/CRL/RA).

One of the suggestions that came out (that I was fond of :) ), was you
provide clients with just their own private key, and the public key of the
server.  The server has its own public/private key, and access to a secure
database containing the clients private keys. This was given the name
'private public-key'. The IKE exchange is standard signature authentication,
with off-line cracking protection.


>From what I can tell from GSS and your draft, it is basically the same
model, except that we are talking about adding a new 'thing' everywhere
called GSS-API software.

Cheers, Steve.