Re: [kitten] SPAKE Preauth

[Benjamin Kaduk <[e-mail]>]

On Fri, 1 May 2015, Ken Hornstein wrote:

> >Speaking for myself, I want to create a high-quality integrated
> >experience, not a generic one. I would prefer picking one open
> >standard (such as OATH) and getting the details right. This is
> >somewhat hard for me to quantify, but it arises from my experience
> >implementing RFC 6560.
>
> So ... I hate to ask this, but does this mean KITTEN is coming around
> to officially deciding that OTP in Kerberos should _not_ use FAST?  I
> will fully admit that I've been out of the Kerberos game for a while,
> but seeing Nathan's description of the challenges with deploying FAST
> makes me realize that I'd run into the exact same problems ... and that
> makes me think that a FAST-based OTP would probably be very challenging
> if you had a diverse Kerberos deployment.  And I simply wouldn't bother
> deploying both FAST and SPAKE; I'd just pick one to make things easier.

Essentially, the answer is different whether OTP is supposed to be the
first (and only) authentication factor, or a second factor to be used in
conjunction with a password.

-Ben