Subject: RE: KISS for PKIX. (Was: RE:Asymmetric authentication

From: "David P. Kemp" <[email-masked]>
Date: Wed, 21 Jul 1999 09:49:08 -0400 (EDT)

> From: "Waters, Stephen" <[email-masked]>
> 
> As you say, if the Phase1 authentication is based on a poorly kept shared
> (group) key, anything can happen without the need to acquire a device. I
> don't see that a well chosen, unique, well secured pre-shared secret is much
> worse than a certificate though.

If the user is going to have to remember and enter a well chosen, unique
shared secret, then why shouldn't he just remember his private key and
do away with XAUTH?

A private key doesn't have to be kept in a PSE on the pilferable
laptop, it could be typed when the user establishes a connection.
A 160 bit private key is (only) 15 S/KEY words, at 11 bits per word.

1/2 :-)