[EMAIL PROTECTED] on 06/08/2000 07:23:32 AM
>"Noel L Yap" <[EMAIL PROTECTED]> writes:
>
>> OK, I've read this, but since I'm a bit of a newbie, I have a couple of
>> questions:
>> 1. Can the SRP authentication be used to authenticate the client to the host
>> without the use of assymetric keys? I understand that this may not be as
secure
>> (since passwords generally have less entropy than keys), but in some
situations,
>> the convenience is worth the risk.
>
>Yes.
>
>One way to look at SRP is to view it like a assymetric system where
>the user's private key is derived from a password. But the
>host-authentication part of it really uses the verifier as a shared
>(symmetric) secret.
>
>> 2. What effects would such a change have on ssh-agent and ssh-add?
>
>You would either have to type the SRP password each time, or tell the
>agent about it. Or just get the hostkey and use the traditional host-
>and userauthentication mechanisms in ssh.
>
>Note that LSH doesn't (yet) have anything like ssh-agent or ssh-add.
>I'm expecting the gateway feature (once that is implemented) to be
>able to replace aah-agent in many cases. See
>http://www.lysator.liu.se/~nisse/lsh/doc/gateway-mode.txt for some
>ideas about that.
This is great! I prefer using SSH to secure CVS, but I don't really like the
key management issue (since I really have to trust the clients not to put the
keys in a safe place (and, sometimes, unsafe places aren't so obviously unsafe);
I would much rather trust them keeping their passphrases secret).
Now, what's the expected time frame or turn-around time for such a project?
Thanks,
Noel
This communication is for informational purposes only. It is not intended as
an offer or solicitation for the purchase or sale of any financial instrument
or as an official confirmation of any transaction. All market prices, data
and other information are not warranted as to completeness or accuracy and
are subject to change without notice. Any comments or statements made herein
do not necessarily reflect those of J.P. Morgan & Co. Incorporated, its
subsidiaries and affiliates.
