[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: charter question re IKE changes
Paul,
>At 9:31 PM -0400 10/11/00, Stephen Kent wrote:
>>certainly we know how to generate and distribte certs to users who
>>already have entries in a Radius database.
>
>Of course, if that was all we needed to do, our lives would be
>simpler and freer from suffering. However, it isn't. Implementations
>of PKI in the user environment have found that distributing the
>private keys associated with the public keys in the certs, and doing
>so in such a way that the user can use the certificate easily and
>flexibly, is the difficult problem. Note that "distributing" is even
>difficult when the private-public pair is generated on the user's
>own device because the private key has to be secured and yet be made
>available through applications that would need the user to sign
>things. We know the technology for doing this, but we have so far
>implemented it in very klunky fashions. Passwords that can be
>memorized by a user seem a lot more attractive to people who don't
>understand how utterly insecure they are (and even to some people
>who do).
Your characterization of the problem does not match mine. We're
working from different models:
- yes, I would expect the user to generate a key pair on the
machine in question, to avoid the problem of "distributing" a private
key. smart cards would be better, and then we incur more costs, but
folks who argue for use of SecurID cards must address the same sorts
of costs of hardware acquisition and distribution. so, if we just
compare passwords to key pairs, it seems quite reasonable to assume
local generation of key pairs.
- no, I would not make this key available to other
applications, and thus would not have to address the second problem
you cite. a key used to authenticate the user for IPsec need not be
used for anything else. trying to impose a one-user one-key
philosophy is asking fro trouble, from a security standpoint, and
from an implementation perspective as well
Given this perspective, remind me again why knowledgeable folks
prefer passwords, IF we provide them with good software for the
initial certificate issuance process, working from an existing
password database :-)
Steve
Follow-Ups:
References: