[7809] in Kerberos
Re: Kerberos 5 and S/Key
daemon@ATHENA.MIT.EDU (Joe Kovara)
Mon Aug 19 01:10:41 1996
To: kerberos@MIT.EDU
Date: Sun, 18 Aug 1996 13:29:53 GMT
From: joek@CyberSafe.com (Joe Kovara)
nectar@kai.communique.net (Jacques Vidrine) in comp.protocols.kerberos wrote:
>[...]
>Before I get in over my head, I'd like to know if any of you have
>tried successfully or not to use Kerberos with S/Key!
>[...]
While the S/Key mechanism is fairly simple to implement, the real problem is the
need to update database(s) when authentication occurs. With most KDC
implementations (single read-write master, multiple read-only slaves, bulk
propagation to slaves), the result is that slave KDCs are rendered useless.
A single master KDC may be fine for small deployments; for larger deployments,
redundancy and load-leveling are mandatory. If you expect to scale your
deployment, you're going to end up at: (1) Deployment is stuck because you can't
add KDCs; (2) A much more sophisticated database distribution mechanism is
required in order to add KDCs. That is a much more difficult problem than
implementing S/Key.
There are variations which eliminate the need to maintain the information in the
KDC database. However, these variations simply move the problem to other
servers/databases, and add additional communication elements to the basic KDC
authentication process.
Regards,
Joe Kovara / CyberSafe Corp. / joek@cybersafe.com
