Subject: RE: Kerberos (Re: minutes from the SECSH working group meeting at the 48th IETF)

From: Joe Salowey <[email-masked]>
Date: Tue, 10 Oct 2000 10:38:52 -0700

Another possibility is to specify a new User authentication method that uses
the external key exchange.

In http://www.ietf.org/internet-drafts/draft-salowey-secsh-kerbkeyex-00.txt
I defined a User Auth type  "external-keyx"  for this purpose.  In this
message the client only has to specify a user name.  The credentials from
the key exchange are then used to see if this user name is valid.  It is
also possible to provide additional credentials (such as an authorization
certificate) in this message.

Joe
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, October 10, 2000 1:58 AM
> To: Tatu Ylonen
> Cc: [email-masked]; [email-masked]
> Subject: Re: Kerberos (Re: minutes from the SECSH working 
> group meeting
> at the 48th IETF)
> 
> 
> Tatu Ylonen <[email-masked]> writes:
> 
> > One possible way to "cleanly" skip userauth is to allow the 
> requested
> > service name to be ssh-conn also in the transport layer service
> > request.
> 
> That's exactly what I'm thinking of. 
> 
> > (I still think it is kind of kludgy - it needs to pass user
> > information from the transport protocol to the connection protocol.
> > However, I cannot think of a cleaner solution without major 
> changes in
> > the protocols.)
> 
> In lsh, I have one object that is responsible for a connection, which
> handles all packet-type dispatch as well as other connection-related
> information that doesn't fit naturally anywhere else. I store a
> user-pointer in that object, and the function initializing the
> ssh-connection service checks that the user pointer is non-NULL, but
> it doesn't care if a value was installed by the key exchange mechanism
> or by the userauth protocol.
> 
> > For SRP an ad-hoc mechanism would probably need to be designed. (I
> > am not familiar with the details of the SRP protocol though.)
> 
> I've tried to do that in draft-nisse-secsh-srp-00.txt, but it needs
> careful review.
> 
> Regards,
> /Niels
>