Subject: [decade] Kerberos protocol for DECADE?

From: Songhaibin <[email-masked]>
Date: Fri, 24 Feb 2012 08:45:04 +0000

Hi all,

I heard some voice about using Kerberos protocol for the authentication and resource control in DECADE. So I spend some time reading RFC4120, and find Kerberos is useful in insecure domain to establish a secure channel between a client and server. The Kerberos server assigns a shared session key, which will be responded from Kerberos authentication server(or Ticket granting server) to the client (there are two copies of the session key. One copy is embedded Ticket and encrypted with the server's key, together with the client's ID, and another copy is encrypted in the client's key.) The client and server will use that session key to secure their communication.

So my conclusion is Kerberos is to build a secure channel between a client and server in a single domain, while inter-domain will get difficult. It does not look like a good candidate to assign network resources from the in-network storage server for content distribution to DECADE compatible application clients.

BR,
-Haibin (as individual)

---

From: David Harrington <[email-masked]>
Date: Fri, 24 Feb 2012 14:18:52 -0500

I recommend asking the security area directors to provide a security
advisor, who can consider your requirements and point you toward an
applicable solution.

--
David Harrington
Director, Transport Area
Internet Engineering Task Force (IETF)
[email-masked]
+1-603-828-1401

On 2/24/12 3:45 AM, "Songhaibin" <[email-masked]> wrote:

>Hi all,
>
>I heard some voice about using Kerberos protocol for the authentication
>and resource control in DECADE. So I spend some time reading RFC4120, and
>find Kerberos is useful in insecure domain to establish a secure channel
>between a client and server. The Kerberos server assigns a shared session
>key, which will be responded from Kerberos authentication server(or
>Ticket granting server) to the client (there are two copies of the
>session key. One copy is embedded Ticket and encrypted with the server's
>key, together with the client's ID, and another copy is encrypted in the
>client's key.) The client and server will use that session key to secure
>their communication.
>
>So my conclusion is Kerberos is to build a secure channel between a
>client and server in a single domain, while inter-domain will get
>difficult. It does not look like a good candidate to assign network
>resources from the in-network storage server for content distribution to
>DECADE compatible application clients.
>
>BR,
>-Haibin (as individual)
>

---

From: Songhaibin <[email-masked]>
Date: Wed, 29 Feb 2012 01:37:58 +0000

Thank you for the reply and the pointer, Alexey.

I think extending existing IETF protocol for resource control in DECADE is reasonable, for example, IMO OAuth can be used for granting third party to access the data objects owned by the resource owner in the DECADE server.  I'm not familiar with ABFAB.  It seems that federation solution is only designed for non-http use? But I will spend time to read those documents in that working group.

BR,
-Haibin (as individual)

From: [email-masked] [mailto:[email-masked]] On Behalf Of Alexey Melnikov
Sent: Wednesday, February 29, 2012 3:03 AM
To: Songhaibin
Cc: [email-masked]
Subject: Re: [decade] Kerberos protocol for DECADE?

On Fri, Feb 24, 2012 at 8:45 AM, Songhaibin <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,
Hi,

I am not saying that Kerberos is the right thing here, but I suggest you look at what ABFAB WG is doing for cross-domain authentication.

BR,
-Haibin (as individual)