Re: [kitten] Any Interest in a Key Delivery Service?

[Ken Hornstein <[e-mail]>]

>> >I have run into a couple of cases where I wanted the kdc to provide --
>> >not a service ticket -- but an actual encryption key for some data at
>> >rest. (Specifically an encrypted disk or a database.)
>> 
>> It seems like a lot of people use KMIP for that.  I think it would make
>> sense to be able to use Kerberos to authenticate to KMIP, but in my brief
>
>I don't know much about KMIP, but it does seem like there is not very
>much that would tie such a service to be part of and/or colocated with
>a Kerberos KDC.  This functionality ought to be providable by a
>"generic kerberized service", i.e., something running elsewhere than the
>KDC that authenticates via kerberos.

Right, that was what I was suggesting.  You can find the KMIP specification
here:

	httb:/docs.oasis-open.org/kmip/spec/v1.2/kmip-spec-v1.2.html

If you look at section 2.1.2, they have a BRIEF mention of Kerberos
where it talks about the Credential structure.  But it's not clear to me
at first glance if there is a spot in the protocol for an AP-REP, much
less a potentially-unlimited series of round trips that you could get
via GSSAPI.  I only mentioned KMIP because that is a protocol designed
to generate, store, and retrieve keys for use in EXACTLY the situation
originally mentioned (it is big in the data at rest world).  It might be
more fruitful to try to adapt KMIP to your needs rather than shoehorn
the KDC into that role.

--Ken