Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Nicolas Williams <Nicolas.Williams@sun.com> Sat, 20 August 2005 06:06 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E6MUw-0006Fg-80; Sat, 20 Aug 2005 02:06:30 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E6MUv-0006FY-EX for secmech@megatron.ietf.org; Sat, 20 Aug 2005 02:06:29 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA00402 for <secmech@ietf.org>; Sat, 20 Aug 2005 02:06:23 -0400 (EDT)
Received: from brmea-mail-4.sun.com ([192.18.98.36]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1E6N4v-000453-BK for secmech@ietf.org; Sat, 20 Aug 2005 02:43:42 -0400
Received: from centralmail2brm.Central.Sun.COM (centralmail2brm.central.sun.com [129.147.62.14]) by brmea-mail-4.sun.com (8.12.10/8.12.9) with ESMTP id j7K66LTW003203 for <secmech@ietf.org>; Sat, 20 Aug 2005 00:06:21 -0600 (MDT)
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.12.10+Sun/8.12.10/ENSMAIL, v2.2) with ESMTP id j7K65ULG011830 for <secmech@ietf.org>; Sat, 20 Aug 2005 00:06:21 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3) with ESMTP id j7K635bp007842; Sat, 20 Aug 2005 01:03:20 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.13.3+Sun/8.13.3/Submit) id j7K60OrN007804; Sat, 20 Aug 2005 01:00:24 -0500 (CDT)
Date: Sat, 20 Aug 2005 00:58:41 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Shumon Huque <shuque@isc.upenn.edu>
Subject: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges
Message-ID: <20050820055834.GA7789@binky.Central.Sun.COM>
References: <7210B31550AC934A8637D6619739CE6905C06510@e2k-sea-xch2.sea-alpha.cisco.com> <Pine.GSO.4.60.0508191330380.16954@ismene> <20050819210308.GI6659@binky.Central.Sun.COM> <20050820031035.GA5352@isc.upenn.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050820031035.GA5352@isc.upenn.edu>
User-Agent: Mutt/1.5.7i
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 2409bba43e9c8d580670fda8b695204a
Cc: secmech@ietf.org
X-BeenThere: secmech@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security mechanisms BOF <secmech.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/secmech>
List-Post: <mailto:secmech@lists.ietf.org>
List-Help: <mailto:secmech-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=subscribe>
Sender: secmech-bounces@lists.ietf.org
Errors-To: secmech-bounces@lists.ietf.org

On Fri, Aug 19, 2005 at 11:10:35PM -0400, Shumon Huque wrote:
> Kerberos has always assumed that the network is completely insecure
> and the general defense against offline dictionary attack is strong
> passwords. I agree that perhaps this isn't enough anymore. But then, 

That's fair for Kerberos IV, but Kerberos V always allowed for new
pre-authentication methods, while Kerberos IV lacked even pre-auth.

> I think the Kerberos community needs to work on standardizing password 
> based pre-authentication mechanisms invulnerable to dictionary attack 
> (perhaps EKE, AEKE, SPEKE, SRP etc). Hardware pre-authentication
> mitigates the threat somewhat. But PKINIT isn't really an option for 
> the many sites that don't plan to authenticate users with public key 
> credentials (or deploy PKI).

Did you attend the SACRED WG meeting at IETF 63?

> At one time, some of us were talking about an EAP method that
> transported Kerberos messages directly. It seems to me that putting
> some effort into completing that work would be immediately useful
> to Kerberos sites that need to deploy 802.1X or 802.11i soon.

Indeed.  That would be an example of framework bindings of a security
mechanisms, as opposed to EAP-GSS, which would be a bridge.

Nico
-- 

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech