[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Ipsec] Re: IKEv2 AUTH payload

On Fri, Apr 16, 2004 at 05:14:42PM -0500, Nicolas Williams wrote:
> On Fri, Apr 16, 2004 at 05:51:57PM -0400, Bill Sommerfeld wrote:
> > > I'm not too familiar with the various user authentication methods,
> > > but do any of these methods support the notion of an authentication
> > > lifetime?
> > 
> > Yes.  (Kerberos is a notable example).
> 
> And plain old PKI too, since certificates have expiration dates.
> 
> Suppose you're using something like kx509 to get short-lived certs
> issued after authenticating with Kerberos V... presumably you'd want
> sessions authenticated with such certs to expire when the certs do.

And the GSS-API (which allows for non-infinity security context
lifetimes).

The right way to make use of Kerberos V, in general, is through the
GSS-API.  I do hope that if and when the IETF goes on to consider how to
authenticate IPsec IDs with Kerberos V that the GSS-API will be used
instead of raw Kerberos V.

Nico
-- 

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec