Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Nicolas Williams <Nicolas.Williams@sun.com> Fri, 26 August 2005 04:51 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E8WBI-0006Yh-4Z; Fri, 26 Aug 2005 00:51:08 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E8WBG-0006Yc-4q for secmech@megatron.ietf.org; Fri, 26 Aug 2005 00:51:06 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA13197 for <secmech@ietf.org>; Fri, 26 Aug 2005 00:51:01 -0400 (EDT)
Received: from nwkea-mail-2.sun.com ([192.18.42.14]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1E8WBq-0007d7-8o for secmech@ietf.org; Fri, 26 Aug 2005 00:51:45 -0400
Received: from centralmail1brm.Central.Sun.COM ([129.147.62.1]) by nwkea-mail-2.sun.com (8.12.10/8.12.9) with ESMTP id j7Q4otHT007732 for <secmech@ietf.org>; Thu, 25 Aug 2005 21:50:55 -0700 (PDT)
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail1brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id j7Q4osfc010307 for <secmech@ietf.org>; Thu, 25 Aug 2005 22:50:55 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3) with ESMTP id j7Q4osxO017245; Thu, 25 Aug 2005 23:50:54 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3/Submit) id j7Q4oqeU017244; Thu, 25 Aug 2005 23:50:52 -0500 (CDT)
Date: Thu, 25 Aug 2005 23:50:52 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: "Salowey, Joe" <jsalowey@cisco.com>
Subject: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges
Message-ID: <20050826045052.GI15718@binky.Central.Sun.COM>
References: <7210B31550AC934A8637D6619739CE6905C8BEEC@e2k-sea-xch2.sea-alpha.cisco.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <7210B31550AC934A8637D6619739CE6905C8BEEC@e2k-sea-xch2.sea-alpha.cisco.com>
User-Agent: Mutt/1.5.7i
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32
Cc: secmech@ietf.org, Bernard Aboba <aboba@internaut.com>
X-BeenThere: secmech@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security mechanisms BOF <secmech.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/secmech>
List-Post: <mailto:secmech@lists.ietf.org>
List-Help: <mailto:secmech-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=subscribe>
Sender: secmech-bounces@lists.ietf.org
Errors-To: secmech-bounces@lists.ietf.org

On Thu, Aug 25, 2005 at 08:48:57PM -0700, Salowey, Joe wrote:
> 
> > EAP-Kerb/IAKERB/GSS is inherently different other EAP methods 
> > because it requires support for the method on the NAS.  That 
> > is, the NAS needs to support Kerberos for a peer to be able 
> > to submit a TGS to the NAS in order to obtain network access. 
> > 
> [Joe] I'm not quite sure what you mean. If a AAA server is not involved
> then this is not really any different than terminating EAP-TLS on a NAS.
> It could also be possible to still involve a AAA and have it terminate
> the method and talk to the KDC. If you are trying to implement a method
> that is evaluated by both the NAS and the AAA in the same transaction
> you are really doing something other than EAP. 

I agree.  It isn't even the case that the peer's realm would have to
have a cross-realm Kerberos V path to the NAS's realm; if there was an
x-realm path from the EAP peer to the NAS then the NAS could just be the
EAP server.  And if there be no such x-realm path then the NAS need not
even know a thing about Kerberos V.

Or am I missing some way in which EAP-Kerb/IAKERB/GSS is fundamentally
different from existing EAP methods [in some bad way]?

Nico
-- 

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech