Subject: Re: Kerberos Digital Signatures ?

From: "Frank Balluffi" <[email-masked]>
Date: Wed, 18 Jun 2003 16:03:58 -0400

Tim,

No, but I guess one idea would be for a KDC to optionally put the public key belonging to a client into the authorization data element of tickets granted to it.

Frank

                      Tim Alsop                                                                                                                  
                      <[email-masked]        To:       [email-masked]                                                           
                      >                                  cc:                                                                                     
                      Sent by:                           Subject:  Kerberos Digital Signatures ?                                                 
                      owner-ietf-krb-wg@achilles.                                                                                                
                      ctd.anl.gov                                                                                                                

                      06/18/2003 02:19 PM                                                                                                        

Hi,

Does anybody know if any IETF work has been done yet to use a KDC to store a fixed (unique for each principal) private key that could be made available to a program on a Kerberos Client system after authentication. The idea being that this private key could be used for digital signature purposes. Obviously to verify the signature a corresponding public key would need to be published somewhere ?

Any thoughts or ideas are welcome ?

Thanks,

Tim.

--

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 18 Jun 2003 13:15:14 -0700

> No, but I guess one idea would be for a KDC to optionally put the public key belonging to a client into the authorization data element of tickets granted to it.

No.  The client doesn't get to see the authorization data.

You're looking for "ticket extensions" and that is not part of RFC1510
or clarifications.

Nico
--