> very clever to bridge from the TLS negotiation to the SRP negotiation.
> this isn't part of any spec/draft that I remember reading so far, have I
> missed that somewhere?
This concept is described in detail in the Telnet over TLS draft as
well as the Telnet AUTH SRP and Telnet AUTH KRB5 drafts.
> My real concern is that there may be some problem using User authentication
> material (name/passwd) for generating shared secret material for the secured
> TLS session. This is really just a hunch or gut feeling that security is
> somehow lessened by basing it on such a small amount of secret data
> (name/passwd). I know that SRP uses random data and both sides generate
> some data for the session that will be cleanly destroyed. I just help
> thinking that this becomes less secure (though really nice and easy for use
> and development and admin!) than using a client key pair. Am I way off
> base?
There should be no such concern given the way that SRP performs
authentication. The strength the session key is not a direct function
of the strength of the password.
> ps...so when SRP appears in a ciphersuite the telnet can the assume that the
> user has been authenticated properly just by virtue of there being a secured
> channel (a la TLS) - at that point the user can just be logged right in - is
> that correct? very cool.... Kerberos allows auth as one name and login as
> another account...that seems like it might be possible here too...I really
> liked that feature. :)
The feature you are looking for is not supported by SRP. SRP does not
provide for separate authorization of Joe's account by someone
authenticated as Jane.
Jeffrey Altman * Sr.Software Designer C-Kermit 7.1 Alpha available
The Kermit Project @ Columbia University includes Secure Telnet and FTP
http://www.kermit-project.org/ using Kerberos, SRP, and
[EMAIL PROTECTED] OpenSSL. SSH soon to follow.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
