Subject: Re: Setting to KRB-WG agenda for IETF 53

From: Jeffrey Altman <[email-masked]>
Date: Tue, 12 Mar 2002 12:02:21 EST

> 
> Do I think using something like TLS is the be-all-end-all solution?
> No.  Do I think it's better than what we have now?  Yes.  Would SRP
> potentially be better?  Probably, but if we're going to have patent
> issues with it I'd rather make progress than sit around doing
> nothing.
> 
> Larry

Just like with the RSA patents.  They won't be around forever.
Everyone made decisions in 1992 based upon the fact that 8 years
seemed like a really long time.  It wasn't.  Design and implement SRP
or similar pre-auth.  It will be used outside the U.S., it will be
used in the open source arena, and by the time it is widely deployed
the patents that might cover it will have expired.

- Jeff

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 available now!!!
 The Kermit Project @ Columbia University   includes Telnet, FTP and HTTP
 http://www.kermit-project.org/             secured with Kerberos, SRP, and 
 [email-masked]                OpenSSL. Interfaces with OpenSSH

---

From: "John Brezak" <[email-masked]>
Date: Tue, 12 Mar 2002 09:28:20 -0800

One big difference is that there is a IPR statement on file with the
IETF for RSA. There is not IPR statement on file for EKE.

Also with this approach, you cannot make this manditory to implement. So
without sufficient protection for the implementers (like the IPR
statements are intended for), this really is not a solution.

This should be taken up with the Security ADs before moving on any
EKE-like proposal.

I'll forward a message from Ted to the [email-masked] list that lays
out some of the EKE issues - look for "RE: Paper about kerberos'
password security".

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]] 
Sent: Tuesday, March 12, 2002 9:02 AM
To: Lawrence Greenfield
Cc: Nicolas Williams; [email-masked]
Subject: Re: Setting to KRB-WG agenda for IETF 53

> issues with it I'd rather make progress than sit around doing nothing.
> 
> Larry

Just like with the RSA patents.  They won't be around forever. Everyone
made decisions in 1992 based upon the fact that 8 years seemed like a
really long time.  It wasn't.  Design and implement SRP or similar
pre-auth.  It will be used outside the U.S., it will be used in the open
source arena, and by the time it is widely deployed the patents that
might cover it will have expired.

- Jeff

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 available
now!!!
 The Kermit Project @ Columbia University   includes Telnet, FTP and
HTTP
 http://www.kermit-project.org/             secured with Kerberos, SRP,
and 
 [email-masked]                OpenSSL. Interfaces with
OpenSSH