Subject: Re: [Ietf-krb-wg] ietf-krb-wg Digest, Vol 36, Issue 8

From: Hasnaa Moustafa <[email-masked]>
Date: Tue, 13 Jul 2010 07:26:21 +0200

Hi,

Please find another clarification on the new submitted draft (showing the
difference or the "why" of the requirements compared to the user-to-user
authentication approach mentioned in the Kerberos specification.
 The proposed approach in the submitted draft is a complemantory approach to
the work on user-to-user authentication defined in Kerberos specification.
The idea is how to benefit from Kerberos in distributed wireless environment
in order to authenticate users based on credentials distributed by a third
part (the KDC in this case) and how to allow the distribution of dynamic
credentials (giving several credentials at one time where each credential is
valid for a certain time duration). The idea is to allow each pair of
communicating users to authenticate first before presenting the TGS for the
application request. The reason for this is that in some scenarios some
wireless terminals could play the role of relays between the application
requestor and the application provider terminals, so presenting the TGS to
these relays would not allow for the authentication (as they do not play the
role of application providers). However, if new credentials are given,
authentication could be fulfilled between each pair of communicating users
of different roles (application requestor-relay), (relay-relay), and
(relay-application provider) which allows transmitting the TGS between the
(application requestor) and (application provider) along an authenticated
path.

Hope that things are more clear now and hope to have more feedback.

Kind regards,
Hassnaa

> ------------------------------
>
> Message: 3
> Date: Thu, 8 Jul 2010 14:33:15 +0200
> From: Hasnaa Moustafa <[email-masked]>
> To: Tom Yu <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [Ietf-krb-wg] New draft submission
> Message-ID:
>        <[email-masked]>
> Content-Type: text/plain; charset="windows-1252"
>
> Hi Tom,
>
> Thanks for your comment.
>
>
>
> Indeed, we believe that Kerberos could be useful in distributed scenarios
> thanks to the distributed nature of its credentials, where these
> credentials
> would be also extended to support the dynamic nature of distributed
> environments.
>
>
>
> We believe that Kerberos could have a wide applicability in distributed
> scenarios (with the several existing social networks applications, the more
> and more interest in multimedia services and user generated content) for
> several facts: the distributed nature of its credentials, the possibility
> to
> deploy it on local servers, introducing the notion of trusted third party
> which could allow the network operator to manage clients? connectivities
> which is a point difficult to achieve in distributed environments.
>
>
>
> Kind regards,
>
> Hassnaa
>
>
>
>
> On Thu, Jul 8, 2010 at 6:27 AM, Tom Yu <[email-masked]> wrote:
>
> > Hasnaa Moustafa <[email-masked]> writes:
> >
> > > Hi,
> > >
> > > A new draft has been submitted on  (The Distributed Authentication
> > Through
> > > Kerberos Tickets: Problem statement and Requirements) :
> > > draft-moustafa-krb-wg-ps-00.txt
> > > http://tools.ietf.org/id/draft-moustafa-krb-wg-ps-00.txt
> > >
> > > Please find the abstract of this draft and please do not hesitate to
> > provide
> > > comments.
> >
> > How much applicability do you believe the existing Kerberos user-to-user
> > authentication capability has to your use case (assuming that I correctly
> > interpret it to be a wide-range distributed peer-to-peer scenario)?
> >
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.anl.gov/pipermail/ietf-krb-wg/attachments/20100708/6dfae59b/attachment.html
> >
>
> ------------------------------
>
> _______________________________________________
> ietf-krb-wg mailing list
> [email-masked]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
>
> End of ietf-krb-wg Digest, Vol 36, Issue 8
> ******************************************
>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg