[saag] Re: SKEX bof comment

Michael Richardson <[email protected]> Mon, 17 Mar 2025 14:09:01 +0700

Newsgroups	gmane.ietf.saag
Message-ID	<745500.1742195341@dyas>

Salz, Rich <[email protected]> wrote:
    mcr> A problem with Kerberos is that the KDC knows all the keys!

    > It does not have to.  Kerberos has the concept of cross-realm
    > authentication.

I don't quite understand you.

I think you are saying two things, which I didn't think are related.

1. Are you saying that it is possible to use Kerberos in a way where the KDC
   doesn't (never!) knows what keys it is wrapping into the tickets?
   (Of course, it can forget them the moment they are wrapped up into
   tickets, sent to the two participants)

2. yes, you can have cross-realm authentication, where two KDCs talk to each
   other.  I know that they was more common in the past, but I'm not
   convinced that it's used that often.  pk-init.. RFC4556 describes a way to
   initialize this using public keys... otherwise, I think one has to use
   sneakernet.  I see SKEX as being that sneakernet.

I have no idea how often cross-realm authenticaiton is actually set in these
modern days of Kerberos is almost always Active Directory.   I've configured
KDCs myself in the very distant past, and used it as a "user" in the past decade.

--
Michael Richardson <[email protected]>, Sandelman Software Works
 -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 658 B)