RE: alternative to user-to-user Kerberos in KINK

["Medvinsky, Sasha (SD-EX)" <SMedvinsky@xxxxxx>]

All I was saying is that although you can do peer-to-peer authentication
with Kerberos, you shouldn't require it for an architecture where you don't
have a peer-to-peer relationship.

Sasha.


> -----Original Message-----
> From: Bill Sommerfeld [mailto:sommerfeld@xxxxxxxxxxxx]
> Sent: Monday, November 20, 2000 11:06 AM
> To: Medvinsky, Sasha (SD-EX)
> Cc: 'Derek Atkins'; 'Michael Thomas'; 'ietf-kink@xxxxxxxx'
> Subject: Re: alternative to user-to-user Kerberos in KINK
> 
> 
> > KINK is a peer-to-peer protocol, 
> 
> yes
> 
> > but Kerberos is not.  
> 
> kerberos is a 3-party protocol involving a KDC and two principals.
> 
> All principals in possession of their long term key can trivially do
> peer-to-peer authentication.  the user-to-user extension in kerberos
> v5 also lets "clients" which only have a TGT do peer-to-peer
> authentication without posession of the long-term key.
> 
> 					- Bill
>