Subject: another low infrastructure gss mechanism

From: Mike Eisler <[email-masked]>
Date: Tue, 2 Mar 1999 17:01:37 -0800 (PST)

I posted an i-d late Friday afternoon. I don't know if it was
received by the deadline, but in any case, it hasn't been posted yet.

Interested folks can read it now via:

	http://playground.sun.com/~mre/draft-ietf-cat-lipkey-00.txt

My notion is to slightly tweak SPKM (RFC 2025) to support anonymous user
authentication in the case when the SPKM inititiator doesn't have the target's
certificate.

A thin GSS mechanism is layered on top of SPKM to transmit a user name and
password, encrypted with an SPKM GSS_Wrap(), to the target. Thus the initiator
and target are mutually authenticated.

I've looked at draft-ietf-cat-gsseasy-00.txt, and I think that each draft
solves different problems. Gsseasy plays well where there is no desire to set
up any public key infrastructure, but requires that the server set up a
user/password infrastructure that might have to in addition to the one that is
native to the server's operating system. 

LIPKEY can utilize the server's native user/password management system, but it
requires:
	- the server to have a public key certificate
	- the client to have a pre-configured list of acceptable CAs.

LIPKEY is modelled on the way that most users of Internet use http/SSL
to conduct secure transactions.

I imagine that some users would prefer gsseasy, others would
prefer LIPKEY. 

	-mre

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 05 Mar 1999 14:25:02 +0100

Mike,

I would not consider LIPKEY as a "low infrastructure" mechanism. I have not get
the time to look at your document, but from what you say it may be interresting to
consider it as a candidate to become a new GSS-API mechanism.

Regards,

Denis

---

From: "michael.eisler" <[email-masked]>
Date: Fri, 5 Mar 1999 07:39:12 -0800 (PST)

> 
> I would not consider LIPKEY as a "low infrastructure" mechanism. I have not
> get the time to look at your document, but from what you say it may be
> interresting to consider it as a candidate to become a new GSS-API mechanism.

Denis,

Perhaps "easy installation" is a better modifier (but then my acronym would go
awry :-)). But that's merely semantics. I'm glad that you see potential merit
in it.

I'll be the next IETF if anyone wants to discuss it and/or lead a discussion
at the CAT session if desired.

	-mre