Re: domain-based service names redux

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Tue, Jun 12, 2007 at 11:03:11PM +0200, Martin Rex wrote:
> I never liked hostbased service names ;-)

Well, we undoubtably need principal names for hosts.  The service part
seems... less necessary.

That said, the service name component does simplify privilege separation
of different applications running on the same host because each can
manage its own keys without impacting the others.  Without service names
one has to ensure that there is a local facility for handling keys that
does not expose them to the apps, at least where said keys can be used
by one app against the other (typically that would be symmetric keys in
a protocol like Kerberos V).

Nico
-- 


_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten