Subject: [Ietf-krb-wg] FW: Kerberos and PKINIT workgroup

From: "Andreas Weber" <[email-masked]>
Date: Wed, 22 Sep 2010 06:20:35 +1000

Hi there,

I joined the distribution list to make it easier :-)

Nico

> The first question (which I should have asked earlier) should be: why 
> is Kebreros ticket forwarding (GSS credential delegation) not 
> sufficient for your use case?

Yes, I thought about it, but this would be impractical, because

a) we want to use the ticket to elevate privileges
b) we want to limit the ticket life to 15'

Andreas

----- Original Message -----
From: Douglas E. Engert <[email-masked]>
Cc: [email-masked] <[email-masked]>; Weber, Andreas
Sent: Tue Sep 21 04:01:31 2010
Subject: Re: [Ietf-krb-wg] Kerberos and PKINIT workgroup

The original e-mail for this thread was from [email-masked] who is not a member of the list. So please include him on the cc:
or he can join the list if he wants.

On 9/20/2010 11:03 AM, Nicolas Williams wrote:
> On Mon, Sep 20, 2010 at 11:19:31AM -0400, Jeffrey Hutzelman wrote:
>> --On Monday, September 20, 2010 10:00:59 AM -0500 "Douglas E.
>> Engert"<[email-masked]>  wrote:
>>> The prompt should be tunneled back to the user... You still need to 
>>> login to the card.  The user could also be using a reader with a key 
>>> pad, so the PIN is never over the wire at all.
>>
>> Sure.  Nico's point is that the prompt should be generated and 
>> handled on the system where the smartcard is; that is, the one in 
>> front of the user, rather than being passed back up the PKCS#11 chain 
>> to the ultimate "application" running on some remote machine.
>
> Yes.
>
>> Unfortunately, PKCS#11 really isn't well-suited to this, because it 
>> doesn't deal well (at all) with slots appearing and disappearing 
>> dynamically.
>
> The way to deal with this is to have make imaginary slots, and then 
> pretend that tokens are inserted/pulled out as necessary.
>
> But, yes, PKCS#11 is a bit clunky an API.
>
>> In any case, we're getting a bit off topic for the ietf-krb-wg list.
>
> Well, most of this subject is going to be.  A remote GSS-API 
> credentials access protocol might fall in KITTEN WG's purview.  
> Everything else has no obviously correct forum at the IETF.  Given 
> that the intention of the OP is to use remote smartcard access for 
> PKINIT, I think it makes sense to discuss some of it here for now.
>
> The first question (which I should have asked earlier) should be: why 
> is Kebreros ticket forwarding (GSS credential delegation) not 
> sufficient for your use case?
>
> Nico

-- 

  Douglas E. Engert  <[email-masked]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg