Subject: RE: What do we want from sshv2?

From: Joe Salowey <[email-masked]>
Date: Mon, 30 Oct 2000 11:12:26 -0800

> When I first encountered the problem (which was with SRP exchange, not
> Kerberos), I thought that the best way to deal with key exchange
> methods that provides user authentication as a side-effect was to
> skipthe ssh-userauth sub-protocol completely. I.e. have the cliet send
> an SSH_SERVICE_REQUEST message that asks for "ssh-connection" rather
> than "ssh-userauth".
> 
> But perhaps something like external-keyx is better. One potential
> advantage is that it makes it possible for a server to require both
> Kerberos authentication *and* authentication using a public key, a
> hardware token or any other mechanism incorporated in the ssh-userauth
> framework.
> 
> I don't understand why the "extra credentials" are added to the
> same message, though. 

I was thinking mainly of credentials providing authorization to the
requested service.  The credentials are tied to the principal identity
authenticated in the key exchange.  This may not be the best place to send
this, but it is the only palce I could send it in the current protocol.  In
th case of kerberos the credential could also be a proxied ticket without
any authorization data that was needed by the service.

Joe

---

From: [email-masked] (Niels M�ller)
Date: 30 Oct 2000 20:43:47 +0100

Joe Salowey <[email-masked]> writes:

> this, but it is the only palce I could send it in the current
> protocol.

Is there any reason you can't use yet another new userauth request
type for that? I.e. first you send a SSH_USERAUTH_REQUEST
"external-keyx", and next a SSH_USERAUTH_REQUEST
"kerberos-extra-auth-whatever"? (You don't even have to wait for the
reply to the first message, if you're concerned about roundtrips).

/Niels