[2226] in Kerberos
Kerberos & X.509
daemon@ATHENA.MIT.EDU (Jamey Maze)
Tue Sep 29 13:55:04 1992
Date: Tue, 29 Sep 1992 17:17:38 GMT
From: jnm@ornl.gov (Jamey Maze)
To: kerberos@shelby.Stanford.EDU
I attended the Interop tutorial on Kerberos last year and the speakers
included a section on X.509 with a comparison of it to Kerberos. X.509 is
based on RSA public-key encryption and I believe the DEC SPX was based on
the X.509 draft standard. Since then I haven't heard anything else about
X.509 or SPX. Is there anything new on that horizon? I'm interested in that
I've been asked to provide input into the security chapter of my company's
5-year computing strategic plan and am looking for potential alternatives
to Kerberos. We will have to show that we've considered all the
alternatives.
It seems that a potential Achilles heel for Kerberos is public-key
encryption, but I remember there being some talk about Kerberos being
adapted for public-key. How serious is such an effort and who is doing it?
Also, what's the status on the development of a generic API for Kerberos
V4, V5, and OSF/DCE? How serious is that effort and who's doing it? Where
can I learn more?
As far as Kerberos implementations, it seems that the OSF/DCE
implementation would hold the most long term promise. I know many of you on
this list will disagree, but at this site, the promise of a standard
Kerberos implementation eventually being bundled with the operating system
was enough to stifle any major investments in 3rd-party support of MIT
Kerberos (either V4 or V5). AFS is being viewed as clear winner and with it
being integrated into OSF/DCE, that's another point in its favor. Since
Project Athena's funding in this area appears to have been redirected into
OSF, it would appear that MIT will not necessarily be taking the lead role
in on-going development in this area. I'd be interested in hearing
thoughtful comments on this evaluation. (No flames please.)
Thanks!
--
Jamey Maze, Oak Ridge National Lab
