Re: [kitten] PKCROSS and philosophical tangents...

[Ken Hornstein <[e-mail]>]

>PKCROSS seems to me to be about providing agility while preserving
>accurate identification. It seems that a section on distributed CA
>schemes may be warranted, if only to put the full PKI scheme in
>context. OTOH: Is it worthwhile to allow implementers to provide
>alternative methods of evaluating trust in certificates? Omar, 2009
>gives an overview that I found helpful. I put some references below
>which may be useful for the draft.

I come from a relatively flexible universe where we do a lot of
cross-realm, so I've thought a significant amount of this (also, we
have a lot of users who aren't part of our organization).  Here are
my thoughts:

- I personally am not a fan of the term "agile" in this context, because
  it's too vague (what, exactly, do you mean by that?).
- PKCROSS seems to me to want to give you the ability to do regular old
  Kerberos cross-realm without having to actually set up symmetric
  cross-realm keys ... and I've done that a lot, and I can testify that
  it's a huge pain.  But it's still Kerberos aside from that.
- If you need Kerberos to access your site's resources, then you have two
  choices: either a) do cross-realm with some place they do have a principal
  with, or b) give them a principal on your KDC.  That's all backended by
  tedious paperwork and ACL settings, but I think in terms of actual
  technology that's what your choices are.
- In my experience the TECHNICAL issues are relatively straightforward; it's
  dealing with management that's the challenge.

I looked at the papers you posted; they seem interesting, but if the goal
is to use one of those systems to get a Kerberos TGT ... well, I'd wonder
what the advantage would be compared to one of the existing systems.

--Ken