On Fri, Nov 24, 2006 at 12:10:27PM +0100, Michael Str?der wrote:
> > Intra-organizational problems in this space
> > are much better addressed by Kerberos, not PKI.
>
> I fail to see why.
- Because the off-line (no on-line oracle, instead a CA issuing long-lived
credentials) certificate model produces credentials that last too long,
and are too difficult to revoke.
- Because there are evolved standards to authenticate services in addition
to people and hosts (the mapping of CNs onto DNS names with http is not
a complete solution).
- Because Kerberos addresses cross-realm authentication without giving
peering CAs full trust, they authenticate their own users in their own
namespace (i.e. REALM) only.
- Because Kerberos support tickets forwarding, supporting distributed job
submission with credentials on the remote systems.
- Because lots of organizations are using Kerberos, and there is little
evidence of deployed general-purpose PKIs outside narrow application
spheres: HTTP/SMTP/VPN host certificate vending.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
