Re: alternative to user-to-user Kerberos in KINK

[Ken Hornstein <kenh@xxxxxxxxxxxxxxxx>]

>This includes both AS_REQ and TGS_REQ.  In my proposal, a Kerberized server
>would not have to generate either.  The key management protocol between the
>IPSec peers is not Kerberos anyway - it just utilizes Kerberos objects for
>authentication.

I understand that, but one of your justifications is that it's easier
to develop a KDC that doesn't have to implement U2U tickets.  My point
is:

a) I'm not convinced it's significantly easier
b) Such a KDC couldn't claim to implement the Kerberos protocol

So I don't think this is a very good argument.

--Ken