[Previous] [Next] [Index] [Thread]

Re: Hello!

Excerpts from mail: 22-Jul-94 Re: Hello! "Simon Cooper"@hardees.r (1891)


> Michael Shiplett <michael.shiplett@umich.edu> writes...

> >  The S-HTTP proposal is rather weak wrt symmetric key encryption. I'm
> >interested any leads on Kerberized HTTP as we have a Kerberos database
> >of 60,000+ users which includes most of the people (students, faculty,
> >and staff) at the University of Michigan. Handing out public key pairs
> >to all these users will be difficult and we need a secured HTTP now,
> >so much of the S-HTTP paper--while very good for a public key
> >environment--is inapplicable here.
> >

>    Being in a similar situation as Michael :-) our proposal includes a
> mechanism to deal with this.  I realize that this seems like a tease, but
> we are not quite ready to formally announce our work.  However, it will be
> possible to speak with Greg Bossert and Walt Drummond at the Toronto IETF
> meeting (July 23-29, ie next week).

>    We are hoping that it will eventually be possible to adopt an Internet
> standard as part of the "security" mechanism, however there are a few
> wrinkles which make the existing standard an unsuitable choice.  For
> example, the GSS-API (RFC 1508) when asked to initiate an authenticated
> context only supports a *mutually* authenticated context -- this implies
> that you must divulge your identity even if you only want to ensure you
> are talking to the correct service.  From a privacy standpoint this is a
> problem.  The Rutgers Team beleives that much of the information provided
> via WWW is public, in the same vein as the contents of a public library.
> Any person can get authentic information from a public library without
> having to identify themselves.  If you object to Radio Shack (and other
> stores) asking for you zip code or telephone number when you use a credit
> card (ie giving them your name) then are certainly going to object to
> mutual authentication :-).

> Simon Cooper,
> Secure WWW Team Member.
> Rutgers University, Network Services.


Michael, regarding Kerberos - we run Kerberos version 5.  Kerberos V5
isn't implemented on the Mac and PC platforms, and while porting would
be a major effort, I believe the main concern is that we really need
something more appropriate for Internet wide use [ kerberos hasn't
become an "internet" authentication mechanism, but more of a local
security service expanded over time]. However, I believe the proposal
being formulated for the secure HTTP protocol has the flexibility to
enable you to implement kerberos v4 as an authentication type.  Simon
Cooer, Greg Bossert or Walt Drummond can confirm whether this correct or
not, but that was my impression from my initial view of their protocol
development.  However, the public key authentication mechanism being
presented by Simon Cooper will probably be more useful to consider
towards more Internet wide uses of authentication. 

If one wanted to use WWW clients for user interface purposes, it would
still be possible to use the Secure HTTP protocol with a securely encrypted
"session" to pass either the kerberos password or  forwardable service
key to a service "gateway" which could either obtain credentials for the
user with the password or deal with the forwardable credentials on
behalf of the user. In fact my plan is to use such a mechanism for X.500
updates, where we now have Kerberos V5 authentication [ I will be
getting the KErberos V5 changes back to Tim Howes soon]. We will have
"web500gw" (an HTTP<->X.500 gateway using LDAP for X.500 access) handle
the credentials aquisition and Kerberos V5 binds to the X.500 server.

Rakesh Patel.
                              Rakesh Patel
                         rapatel@noc.rutgers.edu
             Network Services, Telecommunications Division,
                  Rutgers University Computing Services
                             (908) 932-3436
Follow-Ups: References: