Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

[Charles Clancy <[e-mail]>]

On Wed, 24 Aug 2005, Ali Fessi wrote:

> - What is the benefit of having a TGT as a result of the authentication 
> for EAP?!! With native Kerberos, the TGT is used to get a service ticket 
> from the TGS to access kerberized services. What would be here the 
> kerberized service?! is it just the "network access"?! or is anyone 
> planning to realize different kerberized services at layer 2? Is this a 
> new requirement for 802.11?

Not only would it allow you to obtain a TGT, it would also allow you to 
use an existing TGT to get a "service ticket" for network access.  This is 
probably the less-likely scenario though, since talking to a KDC requires 
network access in the first place.

Consider the case of Win32 AFS on a laptop.  You sign onto the wireless 
network, and you can get a service ticket for AFS without having to 
reauthenticate to the KDC.

Another interesting idea would be to treat each 802.11i AP as a service, 
and you could obtain service tickets for them as you roam.

> - Would PKINIT really be an advantage for EAP?! The point with PKINIT is 
> that it supports authentication of the client with public key 
> cryptography. But isn't this already covered by EAP-TLS?

Well it gets you a TGT.  As long as you think getting a TGT is a good 
idea, then PKINIT would seem useful.

[ t. charles clancy ]--[ [e-mail] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

_______________________________________________
SECMECH mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/secmech