Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges

Shumon Huque <shuque@isc.upenn.edu> Mon, 22 August 2005 04:18 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E73lL-0004qc-0h; Mon, 22 Aug 2005 00:18:19 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1E73lG-0004pr-Is for secmech@megatron.ietf.org; Mon, 22 Aug 2005 00:18:17 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA06569 for <secmech@ietf.org>; Mon, 22 Aug 2005 00:18:11 -0400 (EDT)
Received: from talkeetna.isc-net.upenn.edu ([128.91.197.188]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1E74Lj-000231-QK for secmech@ietf.org; Mon, 22 Aug 2005 00:55:57 -0400
Received: by talkeetna.isc-net.upenn.edu (Postfix, from userid 4127) id 8CAD7443B; Mon, 22 Aug 2005 00:18:08 -0400 (EDT)
Date: Mon, 22 Aug 2005 00:18:08 -0400
From: Shumon Huque <shuque@isc.upenn.edu>
To: Nicolas Williams <Nicolas.Williams@sun.com>
Subject: Re: [SECMECH] Framework Bindings Vs. Mechanism Bridges
Message-ID: <20050822041808.GB27685@isc.upenn.edu>
References: <7210B31550AC934A8637D6619739CE6905C06510@e2k-sea-xch2.sea-alpha.cisco.com> <Pine.GSO.4.60.0508191330380.16954@ismene> <20050819210308.GI6659@binky.Central.Sun.COM> <20050820031035.GA5352@isc.upenn.edu> <20050820055834.GA7789@binky.Central.Sun.COM>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050820055834.GA7789@binky.Central.Sun.COM>
User-Agent: Mutt/1.4.2.1i
Organization: University of Pennsylvania
X-Spam-Score: 0.0 (/)
X-Scan-Signature: bb8f917bb6b8da28fc948aeffb74aa17
Cc: secmech@ietf.org
X-BeenThere: secmech@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Security mechanisms BOF <secmech.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/secmech>
List-Post: <mailto:secmech@lists.ietf.org>
List-Help: <mailto:secmech-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/secmech>, <mailto:secmech-request@lists.ietf.org?subject=subscribe>
Sender: secmech-bounces@lists.ietf.org
Errors-To: secmech-bounces@lists.ietf.org

On Sat, Aug 20, 2005 at 12:58:41AM -0500, Nicolas Williams wrote:
> On Fri, Aug 19, 2005 at 11:10:35PM -0400, Shumon Huque wrote:
> > I think the Kerberos community needs to work on standardizing password 
> > based pre-authentication mechanisms invulnerable to dictionary attack 
> > (perhaps EKE, AEKE, SPEKE, SRP etc). Hardware pre-authentication
> > mitigates the threat somewhat. But PKINIT isn't really an option for 
> > the many sites that don't plan to authenticate users with public key 
> > credentials (or deploy PKI).
> 
> Did you attend the SACRED WG meeting at IETF 63?

No, but I just read a summary of their session. The credential
mobility stuff isn't really relevant to (non PKINIT) Kerberos
sites. So I assume you are referring to the IPR issues with those
protocols. It sounds like there might be some hope though!

> > At one time, some of us were talking about an EAP method that
> > transported Kerberos messages directly. It seems to me that putting
> > some effort into completing that work would be immediately useful
> > to Kerberos sites that need to deploy 802.1X or 802.11i soon.
> 
> Indeed.  That would be an example of framework bindings of a security
> mechanisms, as opposed to EAP-GSS, which would be a bridge.

Agreed.

Some folks at Penn are interested in working on an EAP-Kerberos 
method. Is there anyone else interested in this?

Thanks!
---
Shumon Huque				3401 Walnut Street, Suite 221A,
Network Engineering			Philadelphia, PA 19104-6228, USA.
Information Systems & Computing		(215)898-2477, (215)898-9348 (Fax)
University of Pennsylvania / MAGPI.	E-mail: shuque -at- isc.upenn.edu

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech