Re: [TLS] the use cases for GSS-based TLS and the plea for

[Martin Rex <Martin.Rex at sap.com>]

Nicolas Williams wrote:
> 
> > *I* want to see a requirement for a server credentials in order
> > to put pressure on the interoperability aspect.  Interoperability
> > is important, and the previous specs used a certificate-based
> > credential for this purpose.  We all know pretty well that
> > popular gssapi mechanism like Kerberos5 have a serious
> > inter-organisation interoperability problem, and that is
> > unlikely to go away anytime soon.  So to provide interoperability
> > from the beginning we ought to stick to the one authentication
> > scheme that currently works best cross-organization.
> 
> So why bother with this doc then?  Why not just say: "if you want to use
> TLS then deploy a PKI?"  (And to the question of where to store user
> creds, one answer that comes to mind would be kx509, another would be
> SACRED.)

What I meant (and forgot to add) was "certificate-based credential
(self-signed when no PKI is used) as a mandatory to implement
feature for interoperability".

If support of cert-based credentials is a mere MAY, then I am sure
there will be servers/services where installing or using a PKI
credential is impossible/defective/unusable, and you cannot complain
to the vendor because not-supporting it is fully compliant with the spec.

Everyone will be happy when Kerberos can be used cross-organization
one day.  But until that day, I want to make sure that the customer
has the working alternative to use PKI when there is a need for it.


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls