Subject: RE: Using PDM as a Preauth

From: Tim Alsop <[email-masked]>
Date: Thu, 5 Dec 2002 22:42:17 -0000

Douglas wrote :

>I agree, and we are really waiting to hear from the vendors most affected
by this problem. I had one short offline message from Microsoft, but would
like them to 
>address the list as well. 

I represent CyberSafe (a vendor of commercial Kerberos products/solutions)
and wanted to comment on the potential need for an "urgent" solution to this
problem. We would prefer the focus of attention to be turned more towards
the Kerberos clarifications and the extensions at the moment, and preauth
improvements for password authentication can then be progressed with a
somewhat lower priority. 

Our current products have strong password policy controls and support for
token devices - either/both of these are enough at the moment to put our
customers minds at rest if they become concerned about the kerbcrack tool
(this is the tool that started these discussions). 

Regards, Tim.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 05 Dec 2002 16:55:12 -0600

Thanks for the input. Clarifications is still the WG top priority. We are
waiting for our editor to make the changes from the WG last call and the
WG meeting. We expect to have another last call when the draft is posted. 

In the mean time, the issue of better pre-auth came up, so the list has
been very active in the last few days. As you point out good password policies
are the best defense at the moment to the possible sniffing or MITH attacks.

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444