[2129] in Kerberos
Some Alternative Strategies For Using Kerberos
daemon@ATHENA.MIT.EDU (Will Estes)
Fri Aug 28 05:19:56 1992
Date: 28 Aug 92 05:53:44 GMT
From: westes@netcom.com (Will Estes)
To: kerberos@shelby.Stanford.EDU
I am curious how others who have installed Kerberos are using
it. An initial reading of the overview articles suggests to me three
different ways of using the service:
1) To authenticate the client and server just at the time a client starts
to use a service, after which packets are exchanged without
using the Kerberos ticket.
2) To authenticate each and every packet exchanged between a client and
server using the ticket.
3) To both authenticate each packet using the ticket and also encrypt
application data using the session key.
Approach 1), while not securing all the data that is exchanged between a
client and server, at least seems sufficient to stop an arbitrary client
from using the server (unless of course he is going to start forging
packets at the same time that the authorized client is using the server).
For some environments and applications, that level of security might be
sufficient.
Approaches 2) and 3) seem like they would be a lot of work, especially if you
are trying to retrofit some existing application to use Kerberos.
True/false?
Have I missed some other common approaches for applying Kerberos?
--
Thanks,
Will Estes Internet: westes@netcom.com
