Re: [kitten] Any Interest in a Key Delivery Service?

[Jeffrey Altman <[e-mail]>]

On 9/13/2017 10:02 PM, Ken Hornstein wrote:
> Right, that was what I was suggesting.  You can find the KMIP specification
> here:
> 
> 	http:/docs.oasis-open.org/kmip/spec/v1.2/kmip-spec-v1.2.html
> 
> If you look at section 2.1.2, they have a BRIEF mention of Kerberos
> where it talks about the Credential structure.  But it's not clear to me
> at first glance if there is a spot in the protocol for an AP-REP, much
> less a potentially-unlimited series of round trips that you could get
> via GSSAPI.  I only mentioned KMIP because that is a protocol designed
> to generate, store, and retrieve keys for use in EXACTLY the situation
> originally mentioned (it is big in the data at rest world).  It might be
> more fruitful to try to adapt KMIP to your needs rather than shoehorn
> the KDC into that role.
> 
> --Ken

As far as I can tell, before GSS-API or Kerberos could be used to
authenticate to a KMIP service, TLS would need to be updated to support
Kerberos authentication.  At the moment, KMIP requires TLS 1.2.  See


http://docs.oasis-open.org/kmip/profiles/v1.2/os/kmip-profiles-v1.2-os.html

Alternatively, a new GSS-API protected network protocol could be
developed as a front-end to the KMIP store.  For example, an RXGK
protected RX RPC service would be interesting.

Jeffrey Altman