Subject: Re: Setting to KRB-WG agenda for IETF 53

From: Jeffrey Altman <[email-masked]>
Date: Tue, 12 Mar 2002 11:16:30 EST

>    From: Ken Raeburn <[email-masked]>
>    Date: 12 Mar 2002 04:54:44 -0500
> [...]
>    This scheme does assume that the client has been preconfigured to know
>    the public key for the KDC to be contacted.  This is a bit at odds
>    with the minimal local configuration some of us have been shooting for
>    with DNS SRV records.  It's certainly a reasonable thing to do, but
>    IMNSHO not a desirable thing to require.
> 
> If we're willing to require clients to have some sort of trusted
> public key (and I think this isn't that unreasonable given that we're
> assuming the clients have trusted local software) we might as well
> just use TLS to protect the initial authentication and take advantage
> of the fact that it's already been widely deployed.  Since the WG
> seems to be moving towards requiring TCP for more and more of
> Kerberos, this appears to be workable.
> 
> Larry
> 

Too much overhead per connection.  Not to mention that you must then
have some means of distributing certificates; managing CRLs; or run an
OSCP service.  I run Kerberos as the authentication service to avoid
the need to do these types of things.

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 available now!!!
 The Kermit Project @ Columbia University   includes Telnet, FTP and HTTP
 http://www.kermit-project.org/             secured with Kerberos, SRP, and 
 [email-masked]                OpenSSL. Interfaces with OpenSSH

---

From: Ken Raeburn <[email-masked]>
Date: 12 Mar 2002 13:46:08 -0500

> > Kerberos, this appears to be workable.

I don't think we've been moving towards not allowing UDP exchanges
though, when the packet sizes are small enough.  I'd be opposed to
making Kerberos become TCP-only.

> the need to do these types of things.

Any scheme we come up with that involves KDC public keys is going to
have similar core issues.  With either TLS or LEAF you need to get
keys out to the client, and you need to think about the question of
revocation of those keys and what happens if a revoked key is used
anyways.