Re: [SECMECH] Method work

On Thu, Aug 25, 2005 at 04:33:39PM +0300, Jari Arkko wrote:
> Salowey, Joe wrote:
> >5. Kerberos - Something that provide for initial authentication and a
> >strategy for resisting dictionary attacks.  Applicable to EAP, possibly
> >GSS. 
> > 
> >
> I don't currently see a big customer demand for this. But
> I could be viewing at the wrong "market segment".

It seems to me that that organizations with large Kerberos V deployments
should find it useful to be able to use Kerberos V for user
authentication in EAP applications (wifi, VPN, say).

Or do/would organizations with large Kerberos V deployments find this
feature unappealing for some reason that escapes me?  Perhaps because
they might want EAP to authenticate a device more than a user?  Or
perhaps because they want hardware tokens?  But nothing [technically]
stops one from using hw tokens to store high-quality long-term Kerberos
V secret keys, and then there's PKINIT.

Or maybe such organizations are good at user enrollment wherever they
can't use Kerberos and so don't have a strong need for it in EAP
applications -- they might like it, but they get by without it.

But anyways, a GUAM IAKERB mechanism with GSS-API and EAP framework
bindings would definitely be useful in GSS contexts; so if we undertake
GUAM then the matter of whether EAP-IAKERB is useful seems less relevant
(unless it turns out that a GSS IAKERB mechanism is significantly
without GUAM and EAP in the picture).

> Other: enrollment, perhaps a la what Rohan Mahy wanted
> to do in the last EAP WG meeting.

Enrollment seems like it would be useful in network access technologies.

But for business reasons enrollment needs to be very, er, free form,
involving HTML and friends.

Nico
-- 

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech