RE: Review of draft-zorn-radius-keywrap-07.txt

[Bernard Aboba <aboba@internaut.com>]

> >> In speaking with Russ Housely on the key-wrap issues, Russ indicated
> >> that it would need to be on an end-to-end basis.
> 
> Except that that's not how RADIUS works...

Right.  RADIUS security is between a RADIUS client and server.  There are 
no other entities involved. 

> Under that interpretation, though, 
> I don't think that Kerberos would satisfy the criteria, either: a 
> Kerberos server has knowledge of lots of keys that are used by various 
> parties to protect things that are none of the server's business 
> (e.g., telnet data).  With Kerberos, we get around that little problem 
> by declaring the Kerberos server to be unconditionally trusted.

Right.  It seems to me that the criteria may be too strict.  I'm not sure 
why a Kerberos server can be "unconditionally trusted" but a RADIUS server 
would not be. 

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>