elliptic curve pkinit?

[Rick van Rein]

Hey,


> Has MIT kerberos implemented pkinit with elliptic curve certs/keys?  Some initial searching points me to an informational ietf RFC posted out there, but nothing official.

FWIW, in the ARPA2 project we're working on Realm Crossover (based on
DANE/DNSSEC) which uses ECDHE.  The protocol is almost compatible with
PKINIT, but not quite on account of a technicality (no tickets in the
reply).  The work leaves openings for client-to-KDC access, but doesn't
fill them in.


http://k5wiki.kerberos.org/wiki/Projects/Realm_Crossover_between_KDCs
http://realm-xover.arpa2.net/kerberos.html

A glimpse at upcoming software (and the earlier PoC) are on
https://github.com/arpa2/kxover

-Rick