Subject: RE: another low infrastructure gss mechanism

From: "Linn, John" <[email-masked]>
Date: Thu, 11 Mar 1999 14:10:44 -0500

Recalling several contributors' observations to the list, there are various
possible interpretations for "low-infrastructure"; as a group, we need to
assess which are most important to make mechanisms attractively consumable.
I believe that LIPKEY and GSS-Easy reside at different points within the
general space we've been discussing. 

Both LIPKEY and GSS-Easy are low-infrastructure in the sense of allowing
their users to authenticate without being preregistered into infrastructures
beyond passwords.  If SSL/TLS usage experience is a guide, this
characteristic is valuable; it's one differentiator from existing GSS
mechanisms.  Neither approach requires long-term secret storage at clients.

LIPKEY and GSS-Easy differ, however, as to whether or not a supporting PKI
is required; this affects the sets of environments where they can be
deployed.  Neither requires deployment of new on-line servers. 

Both incorporate ASN.1 processing, which concerns some implementers; this is
probably less of a concern to mechanism consumers, however, except in and as
it indirectly affects code size and availability.  

Neither emphasizes performance as a major distinction relative to other GSS
mechanisms; this doesn't seem like a central attribute of "low
infrastructureness". 

--jl

> ----------
> From: 	michael.eisler[SMTP:[email-masked]]
> Reply To: 	michael.eisler
> Sent: 	Friday, March 05, 1999 10:39 AM
> To: 	Denis Pinkas
> Cc: 	[email-masked]
> Subject: 	Re: another low infrastructure gss mechanism
> 
> > 
> > I would not consider LIPKEY as a "low infrastructure" mechanism. I have
> not
> > get the time to look at your document, but from what you say it may be
> > interresting to consider it as a candidate to become a new GSS-API
> mechanism.
> 
> Denis,
> 
> Perhaps "easy installation" is a better modifier (but then my acronym
> would go
> awry :-)). But that's merely semantics. I'm glad that you see potential
> merit
> in it.
> 
> I'll be the next IETF if anyone wants to discuss it and/or lead a
> discussion
> at the CAT session if desired.
> 
> 	-mre
> 
> ==========================================================================
> This message was posted through the Stanford campus mailing list
> server.  If you wish to unsubscribe from this mailing list, send the
> message body of "unsubscribe ietf-cat-wg" to [email-masked]
> 
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]