[2245] in Kerberos
RE: Kerberos & X.509
daemon@ATHENA.MIT.EDU (Brian Schimpf - DTN 226-5292 02-O)
Fri Oct 2 09:33:33 1992
Date: Fri, 2 Oct 92 08:57:38 EDT
From: Brian Schimpf - DTN 226-5292 02-Oct-1992 0850 <schimpf@tuxedo.enet.dec.com>
To: us1rmc::"jnm@ornl.gov"@took.enet.dec.com
Cc: kerberos@MIT.EDU, schimpf@tuxedo.enet.dec.com
Apparently-To: kerberos@mit.edu
Jamey,
>Also, what's the status on the development of a generic API for Kerberos
>V4, V5, and OSF/DCE? How serious is that effort and who's doing it? Where
>can I learn more?
There is a definition of the Generic Security Service API (GSSAPI.)
There are IETF documents available that describe this work. These are
available via anonymous ftp from nnsc.nsf.net. The base spec is
draft-ietf-cat-genericsec-02.txt, while the C bindings are
draft-ietf-cat-secservice-01.txt. I can also say that OSF is considering
a proposal from us to include an extended GSSAPI in DCE V1.1 but that
decision has not been made yet. Assuming that proposal is accepted we will
(or someone will) extend GSSAPI to accomodate the DCE authorization model.
These extensions would be a strict superset of the currently specified API
(i.e. programs written to the IETF version would run on DCE). GSSAPI is
also included in the current release of Kerberos V5 from MIT unless I'm
mistaken.
In the general area of public key I think it's safe to say that
most of the involved players would agree that public key is the right long
term goal for DCE. How DCE would evolve to public key and in what timeframe
are unanswered questions for now. (These are my opinions and don't reflect
either official Digital policy nor am I attempting to speak for either
OSF or Hewlett-Packard, obviously.)
Thanks,
Brian Schimpf
Digital Equipment Corporation
