Subject: Question about N-factor auth?

From: Ari Huttunen <[email-masked]>
Date: Thu, 14 Dec 2000 20:15:10 +0200

Scott mentioned in the meeting that requirements for N-factor authentication
were added to the requirements document.

Does this include a case where the machine is identified with a machine certificate,
and the user is identified with, let's say, a Secur-ID card? 

I do not wish to discuss whether an unnamed, out-of-scope out-of-scope out-of-scope thing,
accomplishes this, but rather whether doing such a thing is actually a requirement for this WG.
My view is that it's relevant, to account for the worry voiced by the Microsoft guys about
using an untrusted terminal to access company secrets. (The client certificate could also
be an SSL certificate.)

Ari

-- 
Ari Huttunen                   phone: +358 9 2520 0700
Senior Software Engineer       fax  : +358 9 2520 5001

F-Secure Corporation       http://www.F-Secure.com 

F-Secure products: Integrated Solutions for Enterprise Security

---

From: "Scott G. Kelly" <[email-masked]>
Date: Thu, 14 Dec 2000 10:32:46 -0800

Hi Ari,

We discussed this in Pittsburgh, and the general consensus there was
that n-factor authentication should be supported by whatever mechanism
we choose. It appears that both getcert and pic can support n-factor
authentication, although it is not yet clear how a machine cert would be
folded into the authentication process. However, one could envision a
challenge to the client which was signed by the private key and returned
in response, possibly along with the associated cert.

Scott

---

From: Hugo Krawczyk <[email-masked]>
Date: Mon, 18 Dec 2000 18:47:47 +0200 (IST)

> in response, possibly along with the associated cert.

Adding machine authentication to PIC is straightforward: instead of a
one-way authenticated "signature mode" as currently described for PIC
(where only the server signs the exchange) you do a complete signature
mode where the client side performs a signature based on the machine
private key as part of the third PIC message. 

Whether support for machine certificates is needed is a diffeent
question...

Hugo

---

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 18 Dec 2000 20:14:51 -0800

Hi Hugo,

> private key as part of the third PIC message.

Yes, this was obvious to me after Steve's post.

> Whether support for machine certificates is needed is a diffeent

I think this requirement has been clearly indicated. There are cases
where access may be permitted only from specific systems, and in these
cases, the system must be reliably identified, in addition to the user.

Scott