Subject: [TLS] TLS with SPNEGO

From: "Carl Young" <[email-masked]>
Date: Tue, 3 Jul 2007 22:19:13 +0100

Hi,

I hope that this request is not O/T in this list, but I am looking for 
advice on utilising TLS along with SPNEGO using the current versions of TLS 
available on user platforms. My application currently utilizes TLS for 
mutual authentication as well as transport security but certificate/key 
management is proving to be an ongoing issue. The applications run as 
autonomous service processes which use the certificate authentication to 
give a reasonable level of 'comfort' that we know who we are talking to.

In many cases my [particular] clients are not set up with any form of PKI, 
but they usually do have some form of single sign-on such as Kerberos, both 
in the Windows and Unix worlds. In most cases I would be communicating 
within the same realm/domain but in other cases, I have no other option than 
using certificate based authentication.

I would like to amend the inter-node communications to utilize some form of 
negotiation. From my perspective utilizing some form of SPNEGO with TLS 
specified as a security mechanism seems to fit the bill, though I can not 
see that this has been used elsewhere (at least formally). I wouldn't be 
using the SPNEGO from within the O/S [for Windows], but providing an 
implementation derived from the Heimdal SPNEGO implementation.

I would like to see if this is the 'right' way to go, or am I barking up the 
wrong tree.

I appreciate any time you can give me,

Regards,

Carl Young

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls