IETF Logo Mail Archive

Re: [TLS] Design Alternatives for Kerberos + DH

Nikos Mavrogiannopoulos <nmav@redhat.com> Fri, 16 October 2015 21:13 UTC

Return-Path: <nmavrogi@redhat.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B149C1A004A for <tls@ietfa.amsl.com>; Fri, 16 Oct 2015 14:13:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yUx-LHjaKePa for <tls@ietfa.amsl.com>; Fri, 16 Oct 2015 14:13:24 -0700 (PDT)
Received: from mx6-phx2.redhat.com (mx6-phx2.redhat.com [209.132.183.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A0CD1A002A for <tls@ietf.org>; Fri, 16 Oct 2015 14:13:24 -0700 (PDT)
Received: from zmail22.collab.prod.int.phx2.redhat.com (zmail22.collab.prod.int.phx2.redhat.com [10.5.83.26]) by mx6-phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t9GLDN4F014568; Fri, 16 Oct 2015 17:13:23 -0400
Date: Fri, 16 Oct 2015 17:13:23 -0400
From: Nikos Mavrogiannopoulos <nmav@redhat.com>
To: Rick van Rein <rick@openfortress.nl>
Message-ID: <1177744771.34157013.1445030003104.JavaMail.zimbra@redhat.com>
In-Reply-To: <56212653.6050702@openfortress.nl>
References: <56212653.6050702@openfortress.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [94.112.138.148, 10.5.101.182]
X-Mailer: Zimbra 8.0.6_GA_5922 (ZimbraWebClient - FF38 (Linux)/8.0.6_GA_5922)
Thread-Topic: Design Alternatives for Kerberos + DH
Thread-Index: f0dZjKwTCgL0b26bbJDDzf8VwfTS4A==
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/mHBTtkdcdKdhdJi1-ZMbo5ON4Tg>
Cc: tls@ietf.org
Subject: Re: [TLS] Design Alternatives for Kerberos + DH
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 16 Oct 2015 21:13:25 -0000

----- Original Message -----
> Hello,
> 3) Similar to OpenPGP: Negotiate cert-type
> 
> There is a cert-type for X.509 and for OpenPGP; add one for Kerberos Tickets.

> PRO: Good integration with TLS: Tickets are transported in the
> ClientCertificate, and an Authenticator is the ClientVerify.  DH is
> independent and can move to the earlier phase for TLS 1.3.
> CON: Decision on client credential type must be made in ClientHello, when not
> all data may be available (namely, the sequence of tickets leading to the
> TLS-protected service).  Also impacts the cert-type used in the ServerCert.


What messages do you need to transfer for Kerberos? Is it only a ping-pong? In that
case, do the supplemental data from RFC4680 provide a solution with PSK in TLS 1.2?

regards,
Nikos

v2.23.0 | Report a Bug | By Email