Subject: RE: Operational Protocols - LDAPv3

From: "David Chadwick" <[email-masked]>
Date: Mon, 10 Jul 2000 20:07:47 +0100

From:           	"Miklos, Sue A." <[email-masked]>
To:             	"[email-masked]'" <[email-masked]>, [email-masked]
Copies to:      	"Kemp David P." <[email-masked]>, [email-masked]
Subject:        	RE: Operational Protocols - LDAPv3
Date sent:      	Mon, 10 Jul 2000 10:33:00 -0400

> Forgive what may be an ignorant question, but if the client 'verifies'
> the server, does that indicate some form of two-way strong
> authentication? 
> 
Sandi

You know it was not an ignorant question :-)

> we ran into issues when trying to require two way strong
> authentication. The client required a crl to complete the path
> processing on the signed bind response from the server. (this is my
> understanding of 'verifying' the server) 

Clearly there is a bootstrapping problem here. Although verify does 
not necessarily mean dig sigs, (though it could). It could be hashed 
passwords. If it is dig sigs, the client could hold off veryifying the 
bind until the crls had been retrieved, that would be one solution. 
But I would rather not get into the mire of saying how you verify the 
server if you dont mind. This note was merely meant as a 
cautionary one to alert the reader to the possibility of a rare and 
sophisticated attack that is possible. That's all.

> 
> Subsequently, it was easiest to allow unauthenticated reads to
> retrieve CRLs at start up.

Ease of use does often conflict with tight security as I mentioned in 
my previous message. It is always a balancing act

David

***************************************************

David Chadwick
IS Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 790 167 0359
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************

---

From: "David Chadwick" <[email-masked]>
Date: Mon, 10 Jul 2000 20:07:47 +0100

Sandi

David

David Chadwick