Subject: 3rd party auth within HTTP

From: James G Smith <[email-masked]>
Date: Wed, 09 Aug 2000 17:42:03 -0500

My apologies if this seems wildly off target for this group.  If 
the CAT WG list would be more appropriate, I can repost there.

I am looking for some security criticism of a draft authentication 
scheme with an eye towards being able to get as close to Kerberos 
as possible but still be within HTTP -- basically a somewhat 
weakened Kerberos for HTTP.  My area of expertise is much closer
to HTTP than Kerberos.

An initial draft is available as

     draft-smith-http-third-party-authentication-00.txt

and may be found at

 http://hex.tamu.edu/drafts/draft-smith-http-third-party-authentication-00.txt

The basic question is whether or not the framework provided in 
this draft may be sufficient to provide a reasonably secure 
authentication scheme similar in behavior and benefits to 
Kerberos.

Items not yet addressed: replay attacks, credential revocation, 
  credentials allowed for multiple sites (currently only allowed 
  as a direct response to a request for credentials), ...
--
James Smith <[email-masked]>, 979-862-3725
Texas A&M CIS Operating Systems Group, Unix

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 14 Aug 2000 10:10:49 -0500

> the CAT WG list would be more appropriate, I can repost there.

It might be a little off target, as it sounds like you would like Kerberos
but without Kerberos. YBut you might get some interest from the mailing list. 

I would like to point out, that the Kerberos protocol does not call
for any transport mechanism between the client and server, only
between the client and KDC. This means that you could use HTTP 
between the client and server and send actual Kerberos tickets. 

You might also want to look at http://www.ietf.org/rfc/rfc2712.txt
"Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)"

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444