Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Dear all,

I still don't get the point for using Kerberos as EAP method.

- What is the benefit of having a TGT as a result of the authentication 
for EAP?!! With native Kerberos, the TGT is used to get a service ticket 
from the TGS to access kerberized services. What would be here the 
kerberized service?! is it just the "network access"?! or is anyone 
planning to realize different kerberized services at layer 2? Is this a 
new requirement for 802.11?

- What would be the benefit of such a EAP-Kerberos (or EAP-IAKERB) 
method compared to existing EAP methods that are currently used, e.g. 
EAP-TTLS+PAP with a radius/diameter server at the end (except that this 
method might be a "misuse" of kerberos as mentioned earlier in this 
mailing list). What would be the arguments that would motivate operators 
to substitute their infrastructure with a new one supporting 
EAP-Kerberos or EAP-IAKERB?

- Would PKINIT really be an advantage for EAP?! The point with PKINIT is 
that it supports authentication of the client with public key 
cryptography. But isn't this already covered by EAP-TLS?

- Wouldn't be helpful to talk to the authors of the EAP GSS draft 
(Aboba) and find out why they stopped to work on this document?

IMHO, it seems that it makes sense to combine different frameworks with 
different authentication mechanisms as intended by secmech. But I just 
would like to have some clarification, why this would be useful.

Any comments are welcome!
Thanks,
Ali.
-- 
Ali Fessi
Computer Networks and Internet
Wilhelm Schickard Institute for Computer Science
University of Tuebingen, Germany
Phone: +49 7071 29-70534 / Fax: +49 7071 29-5220
EMail: ali.fessi@uni-tuebingen.de
Web: http://net.informatik.uni-tuebingen.de/~fessi/

Nicolas Williams wrote:
 > On Mon, Aug 22, 2005 at 10:48:45AM -0400, Charles Clancy wrote:
 >
 >>On Mon, 22 Aug 2005, Josh Howlett wrote:
 >>
 >>>Out of curiousity, what are the advantages of using native Kerberos,
 >>>rather than PAP inside a tunneled method which the AAA server verifies
 >>>against the KDC? (this is how FreeRADIUS currently implements 
"Kerberos"
 >>>authentication).
 >>>
 >>>Perhaps I'm being a bit dim, but I feel like I'm missing the point.
 >>>
 >>>Or is the point simply to define a mechanism that EAP and GSS can share?
 >>
 >>I'm not very familiar with this mechanism, but it doesn't like like you
 >>could get a TGT as a result of your authentication.
 >
 >
 > Exactly.  Plus, you don't get the benefit of new Kerberos V pre-auth
 > mechanisms, (e.g., PKINIT).
 >
 > Nico

Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Attachment: smime.p7s