Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

[Bernard Aboba <[e-mail]>]

> Not only would it allow you to obtain a TGT, it would also allow you to use an
> existing TGT to get a "service ticket" for network access.  This is probably
> the less-likely scenario though, since talking to a KDC requires network
> access in the first place.
 
EAP-GSS permitted an EAP peer to talk to the Kerberos server as part of 
the process of obtaining network access. 

> Consider the case of Win32 AFS on a laptop.  You sign onto the wireless
> network, and you can get a service ticket for AFS without having to
> reauthenticate to the KDC.
> 
> Another interesting idea would be to treat each 802.11i AP as a service, and
> you could obtain service tickets for them as you roam.

That's not a particularly appealing if each NAS requires a distinct 
TGS and each TGS requires a roundtrip between the peer and KDC.  


_______________________________________________
SECMECH mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/secmech