[22431] in Kerberos
Re: Does Kerberos Encrypt Authentication AND Traffic?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Fri Sep 10 18:21:50 2004
From: Russ Allbery <rra@stanford.edu>
Date: Fri, 10 Sep 2004 15:09:23 -0700
Message-ID: <87u0u593os.fsf@windlord.stanford.edu>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
testls <testls@netscape.net> writes:
> Does Kerberos Encrypt Authentication AND Traffic?
> Some are saying that Kerberos will only encrypt the authentication.
> Others are saying that Kerberos will encrypt BOTH the AUTHENTICATION and
> the TELNET SESSION.
> Which is true?
If you're talking about the telnet/telnetd implementation that comes with
MIT Kerberos, both are true. Authentication and encryption are separately
negotiated, so you can choose whether to encrypt only the authentication
or encrypt both the authentication and the rest of the session.
If you're talking about Kerberos in the purest, most minimal sense as a
wire protocol, it provides a mechanism for negotiating a session key but
does not deal directly with what to do with that session key afterwards.
If you're talking about GSSAPI as a wire protocol, it has a mechanism for
negotiating privacy.
So it all depends on what context you're discussing these things in.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
