Re: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

On Mon, Aug 22, 2005 at 01:08:09PM +0200, t.otto@sharevolution.de wrote:
> 
> There already exists a Kerberos extension to TLS, RFC 2712 (Oct.99),
> which can be run in EAP-TLS, so the question is: 
> 
> * Is there need for EAP-Kerberos at all? * 

RFC 2712 doesn't provide for initial and service ticket 
acquisition. So, at the very least an EAP method that
allows you to do that needs to be developed.

> So before all, we should investigate in how far EAP-Kerberos improves
> the TLS-based solution. 
> 
> For instance, the mandatory resistance to dictionary attacks. Thomas Wu
> has given in his Kerberos paper a hint how to mitigate this, however,
> even if there is a strong-password protocol without IPR claims,
> strong password methods suffer in general from heavy computation and thus
> the EAP method would have worse performance.

That's true. But as long as performance is good enough, it
might be okay. It's probably certainly an issue for handheld
devices needing to use it.

--Shumon.

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech