Subject: User to User Kerberos

From: Tim Alsop <[email-masked]>
Date: Tue, 4 May 2004 18:45:40 +0100

Hi,
 
Is user to user Kerberos considered to be ok to use, broken or some other status ? I am not refering to u2u with GSS, just u2u with Kerberos tickets. The reason for asking is that this approach is being considered for WS-Security (Web Services Security) standard being progressed within OASIS WSS TC.
 
Thanks, Tim.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 04 May 2004 16:06:25 -0400

>>>>> "Tim" == Tim Alsop <[email-masked]> writes:

    Tim> Hi, Is user to user Kerberos considered to be ok to use,
    Tim> broken or some other status ? I am not refering to u2u with
    Tim> GSS, just u2u with Kerberos tickets. The reason for asking is
    Tim> that this approach is being considered for WS-Security (Web
    Tim> Services Security) standard being progressed within OASIS WSS
    Tim> TC.

It is very challenging to  get right, but is not broken.

I'd recommend that any use of it be reviewed by this working group or
at least by the IETF security area.