Subject: Relationship between user name and public key pair in Authentication Protocol

From: Miao Fuyou <[email-masked]>
Date: Wed, 19 Mar 2003 10:51:33 +0800

Hi, Tatu & Tero:
 
 I have a doubt on draft-ietf-secsh-userauth-16.txt.  
 
 In section 2.1, there is: 
"In any case, if the user does not exist, the authentication request
MUST NOT be accepted." 
 
In section 4, there is a sentence like: 
"When the server receives this message, it MUST check whether the
supplied key is acceptable for authentication, and if so, it MUST check
whether the signature is correct." 

Now the question is: Is there any RELATIONSHIP between the user name and
the public key? For example, public key K1 is only used by user U1.  

If there is relationship, what is it? 1:1, 1:n, n:1 or m:n? I prefer to
1:1 and 1:n because n:1 and m:n have serious security problem.  

Looking forward to your response!

Yours  
Miao

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 19 Mar 2003 16:53:56 -0500

Existing implementations allow a m:n relationship between user keys
and user names; the client specifies the target user id and a key, and
the server consults a per-target-user acl (typically a file named
something like .ssh/authorized_keys in the target user's home
directory) which lists keys allowed to log in as the given target
user.

Nothing prevents the same key from appearing on multiple acls, but
it's an unusual configuration.

					- Bill