Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

[Charles Clancy <[e-mail]>]

On Mon, 22 Aug 2005, Josh Howlett wrote:

> --On Monday, August 22, 2005 10:19:53 -0400 Charles Clancy 
> <[e-mail]> wrote:
>
>> On Mon, 22 Aug 2005, Josh Howlett wrote:
>> 
>>> On Mon, 22 Aug 2005, Charles Clancy <[e-mail]> wrote:
>>> 
>>>> Personally, I think a native EAP-Kerberos method that utilizes DTLS is
>>>> the way to go.
>>> 
>>> Why not take something like TTLSv1 and define a Kerberos binding to it?
>> 
>> I guess it's a tradeoff between outside dependencies and reinventing the
>> wheel.  TTLS hasn't been on the list of EAP methods seeking
>> standards-track action.  Regardless, this is another approach I
>> personally would be willing to support.
>
> Out of curiousity, what are the advantages of using native Kerberos, rather 
> than PAP inside a tunneled method which the AAA server verifies against the 
> KDC? (this is how FreeRADIUS currently implements "Kerberos" authentication).
>
> Perhaps I'm being a bit dim, but I feel like I'm missing the point.
>
> Or is the point simply to define a mechanism that EAP and GSS can share?

I'm not very familiar with this mechanism, but it doesn't like like you 
could get a TGT as a result of your authentication.

[ t. charles clancy ]--[ [e-mail] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

_______________________________________________
SECMECH mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/secmech