[37924] in Kerberos
Re: elliptic curve pkinit?
daemon@ATHENA.MIT.EDU (Rick van Rein)
Mon Apr 3 08:36:55 2017
Message-ID: <58E241C2.5040208@openfortress.nl>
Date: Mon, 03 Apr 2017 14:36:18 +0200
From: Rick van Rein <rick@openfortress.nl>
MIME-Version: 1.0
To: krb@pallissard.net
In-Reply-To: <55518f4c-6b7d-f510-b637-460d6391be58@pallissard.net>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hey,
> Has MIT kerberos implemented pkinit with elliptic curve certs/keys? Some initial searching points me to an informational ietf RFC posted out there, but nothing official.
FWIW, in the ARPA2 project we're working on Realm Crossover (based on
DANE/DNSSEC) which uses ECDHE. The protocol is almost compatible with
PKINIT, but not quite on account of a technicality (no tickets in the
reply). The work leaves openings for client-to-KDC access, but doesn't
fill them in.
http://k5wiki.kerberos.org/wiki/Projects/Realm_Crossover_between_KDCs
http://realm-xover.arpa2.net/kerberos.html
A glimpse at upcoming software (and the earlier PoC) are on
https://github.com/arpa2/kxover
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
