Kerberos vs. LDAP for authentication -- any opinions?

[Douglas E. Engert]

I would say kx509 is not covered by the patent, The KCA is not
a repository for a users certificate and private key.  Kx509 generates
a new keypair each time it is called and sends a X509 request with the 
public key to the KCA which signs the request creating a new certificate 
each time.  This is it not a key repository. The KCA never sees the 
private key. The private key does not go over the network.  

But, based on the snippet you sent, storing the private key in a 
authenticated encrypted distributed file system so the user could retrieve 
it might be covered by the patent! Which would make me believe the patent 
might not hold up. 
 

Anyway, I was not trying to get into a patent discussion, I was pointing
out that kx509 is a great way to use Kerberos authentication with existing
browsers and web servers. 


"Dr. Greg Wettstein" wrote:
> 
> On Jan 30, 11:05am, Peter Honeyman wrote:
> } Subject: Re: Kerberos vs. LDAP for authentication -- any opinions?
> 
> Good afternoon to everyone, hope that your respective weekends are
> going well.  Just a note before I head out with the Golden Retriever
> for an afternoon of x-country skiing in the new snow.
> 
> I hope the following attributions are correct.  Additional comments
> below.
> 
> > > On Jan 29,  8:45am, "Douglas E. Engert" wrote:
> > > } Subject: Re: Kerberos vs. LDAP for authentication -- any opinions?
> > >
> > >> Many of the Browser issues can be addressed by Kx509 from the
> > >> Univrsity of Michigan. It can obtain a short term X509 certificate
> > >> using Kerberos for authenticaiton. The certificate and key are then
> > >> stored so the browser can use it with SSL to any web server. It works
> > >> with IE and Netscape on Windows. It runs on UNIX and Mac as well.
> > >>   http://www.citi.umich.edu/projects/kerb_pki/
> > >
> > > Didn't Whit Diffey file a patent which covered the concept of using
> > > short-term certificates as authentication brokers?
> > >
> > > If so does the Kx509 stuff have some sort of divine absolution with
> > > respect to it?
> 
> > a search on the patent office shows only two patents with diffie listed
> > as an inventor: diffie-hellman, and "Method and apparatus for privacy
> > and authentication in wireless networks" which doesn't seem to apply.
> >
> > i have cc'ed greg wettstein for clarification.
> 
> I just checked my archived e-mail and notes on this.  My remembrance
> of this stuff was from when I was involved with an ill-fated startup
> centered around my IDfusion technology for, interestingly enough with
> respect to this thread, inherently secure directory based
> authorizations.
> 
> The patent that I was remembering was not by Whit Diffey rather it was
> by a company (Arcot) who has Dr. Hellman on their Board of Directors.
> Guilt by association I guess.... :-)
> 
> For anyone who is interested the relevant patent is #6,263,446 issued
> to Kausik et.al on July 17th, 2001.  The patient is titled 'Method and
> apparatus for secure distribution of authentication credentials to
> roaming users.'  I have snipped and pasted the abstract below:
> 
>         A roaming user needing an his authentication credential (e.g.,
>         private key) to access a computer server to perform an
>         electronic transaction may obtain the authentication
>         credential in an on-demand fashion from a credential server
>         accessible to the user over a computer network. In this way,
>         the user is free to roam on the network without having to
>         physically carry his authentication credential. Access to the
>         credential may be protected by one or more challenge-response
>         protocols involving simple shared secrets, shared secrets with
>         one-to-one hashing, or biometric methods such as fingerprint
>         recognition. If camouflaging is used to protect the
>         authentication credential, decamouflaging may be performed
>         either at the credential server or at the user's computer.
> 
> Before I get jumped on let me state clearly and for the record that I
> don't mean to suggest that Kx509 is infringing or the above is even
> relevant.  After my experiences, believe me, I can write a book on why
> anyone who is even remotely interested in seeing open-source or
> open-protocol solutions succeed want nothing to do with this patent
> mess.
> 
> It would take a boatload of attorneys to actually figure out whether
> the above is relevant with respect to Kx509.  The cost of something
> like that is probably why the whole patent scene is as dangerous as it
> is.
> 
> The notion of solving the portability problem of PKI by accessing a
> private key and/or certificate at demand time is a relevant problem.
> Thats why the above patent has always given me pause when I think
> about architectures such as Kx509.
> 
> >       peter
> 
> Best wishes for a pleasant weekend to everyone.
> 
> Greg
> 
> As always,
> Dr. G.W. Wettstein, Ph.D.   Enjellic Systems Development, LLC.
> 4206 N. 19th Ave.           Specializing in information infra-structure
> Fargo, ND  58102            development.
> PH: 701-281-1686
> FAX: 701-281-3949           EMAIL: greg at enjellic.com
> ------------------------------------------------------------------------------
> "Open source code is not guaranteed nor does it come with a warranty."
>                                 -- the Alexis de Tocqueville Institute
> 
> "I guess that's in contrast to proprietary software, which comes with
>  a money-back guarantee, and free on-site repairs if any bugs are found."
>                                 -- Rary
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

-- 

 Douglas E. Engert  <DEEngert at anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444