Subject: Re: Question about N-factor auth?

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 14 Dec 2000 13:00:29 -0800

In message <[email-masked]>, "Scott G. Kelly" writes:
>Hi Ari,
>
>We discussed this in Pittsburgh, and the general consensus there was
>that n-factor authentication should be supported by whatever mechanism
>we choose. It appears that both getcert and pic can support n-factor
>authentication, although it is not yet clear how a machine cert would be
>folded into the authentication process. However, one could envision a
>challenge to the client which was signed by the private key and returned
>in response, possibly along with the associated cert.
>

Or, as Ari noted, a machine-specific certificate could be used to 
authenticate the TLS session used in getcert.

		--Steve Bellovin