Re: #22

On Feb 8, 2005, at 18:17, Michael Thomas wrote:
> This all comes down to what constitutes a "session". I'd
> argue that it would be a lot better if Kerberos "sessions" (ie, tickets
> and their lifetimes) provided the notion of PFS since
> that would cover every protocol that implements kerberos
> authentication instead of the piecemeal approach that
> each kerberos application needs to deal with PFS itself.

There's been talk occasionally about doing this.  We've had to fix up 
some problems in the basic protocol spec first, though, and that's been 
taking too long.

> That and the place that I'd think you _really_ want PFS
> is for the AS-REQ/AS-REP since that's where the most
> vulnerable piece of information is exchanged (ie, the
> password).

Well, the password is not sent, but yes, the AS exchange is the obvious 
place to start.  Various preauthentication schemes should be able to 
add PFS easily, if desired, and at least one has been proposed.

Ken