Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Bernard Aboba <aboba@internaut.com> Wed, 24 August 2005 21:22 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E82hi-0006cx-Gu; Wed, 24 Aug 2005 17:22:38 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E80XL-0007I7-Dd for secmech@megatron.ietf.org; Wed, 24 Aug 2005 15:03:47 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11792 for <secmech@ietf.org>; Wed, 24 Aug 2005 15:03:44 -0400 (EDT)
Received: from outbound.mailhop.org ([63.208.196.171] ident=mailnull) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1E80Xg-0003aF-LO for secmech@ietf.org; Wed, 24 Aug 2005 15:04:08 -0400
Received: from c-67-182-139-247.hsd1.wa.comcast.net ([67.182.139.247] helo=internaut.com) by outbound.mailhop.org with esmtpa (Exim 4.51) id 1E80XI-000O2a-3p; Wed, 24 Aug 2005 15:03:44 -0400
Received: by internaut.com (Postfix, from userid 1000) id 2414160DC2; Wed, 24 Aug 2005 12:03:43 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by internaut.com (Postfix) with ESMTP id 1602C60DAD; Wed, 24 Aug 2005 12:03:43 -0700 (PDT)
X-Mail-Handler: MailHop Outbound by DynDNS.org
X-Originating-IP: 67.182.139.247
X-Report-Abuse-To: abuse@dyndns.org (see http://www.mailhop.org/outbound/abuse.html for abuse reporting information)
X-MHO-User: aboba
Date: Wed, 24 Aug 2005 12:03:43 -0700 (PDT)
From: Bernard Aboba <aboba@internaut.com>
To: Charles Clancy <clancy@cs.umd.edu>
Subject: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges
In-Reply-To: <Pine.GSO.4.60.0508241335240.11596@ismene>
Message-ID: <Pine.LNX.4.61.0508241201060.16086@internaut.com>
References: <Pine.GSO.4.60.0508191330380.16954@ismene> <20050819210308.GI6659@binky.Central.Sun.COM> <20050820031035.GA5352@isc.upenn.edu> <43074F76.8000604@cs.umd.edu> <20050822044255.GC27685@isc.upenn.edu> <Pine.GSO.4.60.0508220801430.1114@ismene> <35850EE42DFD2824F0DDBBC8@cumulus> <Pine.GSO.4.60.0508221008260.1174@ismene> <1DCACCAC04655B3AFE9733A8@cumulus> <Pine.GSO.4.60.0508221047001.1307@ismene> <20050822154044.GE7789@binky.Central.Sun.COM> <430CA545.3020109@uni-tuebingen.de> <Pine.GSO.4.60.0508241335240.11596@ismene>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Score: 0.1 (/)
X-Scan-Signature: 856eb5f76e7a34990d1d457d8e8e5b7f
X-Mailman-Approved-At: Wed, 24 Aug 2005 17:22:36 -0400
Cc: secmech@ietf.org
X-BeenThere: secmech@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security mechanisms BOF <secmech.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/secmech>
List-Post: <mailto:secmech@lists.ietf.org>
List-Help: <mailto:secmech-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=subscribe>
Sender: secmech-bounces@lists.ietf.org
Errors-To: secmech-bounces@lists.ietf.org

> Not only would it allow you to obtain a TGT, it would also allow you to use an
> existing TGT to get a "service ticket" for network access.  This is probably
> the less-likely scenario though, since talking to a KDC requires network
> access in the first place.
 
EAP-GSS permitted an EAP peer to talk to the Kerberos server as part of 
the process of obtaining network access. 

> Consider the case of Win32 AFS on a laptop.  You sign onto the wireless
> network, and you can get a service ticket for AFS without having to
> reauthenticate to the KDC.
> 
> Another interesting idea would be to treat each 802.11i AP as a service, and
> you could obtain service tickets for them as you roam.

That's not a particularly appealing if each NAS requires a distinct 
TGS and each TGS requires a roundtrip between the peer and KDC.  


_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech