[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: charter question re IKE changes

FWIW, I have been working on a Web-based CA that allows a user to
obtain a certificate based upon an existing username/password.  It's
currently setup for web-client certificates (netscape/msie/lynx) but
it could be extended to others as well.

As Steve said, it's not difficult to create such a beast.  However
Paul is right in that nobody has, as of yet, delivered one.

FWIW, at MIT I've setup an IPSec-based tunnel server that uses
HTTPS+Certificates for secure administration.  A user generates their
RSA key and then submits it via SSL for entry into the IPSec database.
They have to use their certs obtained as above.  There ya go!
Automated "password" sharing of RSA keys based upon existing
username/password entries :)

-derek

Paul Hoffman / VPNC <paul.hoffman@vpnc.org> writes:

> At 12:51 PM -0400 10/12/00, Stephen Kent wrote:
> >Given this perspective, remind me again why knowledgeable folks 
> >prefer passwords, IF we provide them with good software for the 
> >initial certificate issuance process, working from an existing 
> >password database :-)
> 
> Because we don't. I agree with your perspectives about how it *could* 
> work, but that's not what is being delivered. Today's users make 
> choices based on what is available to them today.
> 
> I also think the market disagrees with you about smart cards. Smart 
> cards are only useful where there are smart card readers. They become 
> an obstacle where there are no readers.
> 
> Again, I fully support the use of certs and wish that more users 
> agreed with me. But they don't, and designing a protocol around a 
> wish that has had plenty of time to come true but hasn't is a good 
> way to design yet another protocol that won't get implemented.
> 
> --Paul Hoffman, Director
> --VPN Consortium

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       warlord@MIT.EDU                        PGP key available
References: