Re: public key vs passwd authentication?
From: Anne & Lynn Wheeler (lynn_at_garlic.com)
Date: 09/30/03
- Previous message: solaris9000: "How to forced password change via ssh?"
- In reply to: dkoleary_at_attbi.com: "public key vs passwd authentication?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 30 Sep 2003 18:32:55 GMT
dkoleary@attbi.com writes:
> Does anyone have any links to good solid white papers comparing the
> pros/cons of passwd vs public key authentication?
>
> I have a client that's turned off public key authentication. In order
> to make them change their minds I have to develop a paper describing
> why public/private key authentication is so cool.
>
> I have several sources already including the O'Reilly's book; however
> if someone's already done the comparison along with an indepth
> examination of the security aspect, it'd make my job a lot easier/
> quicker, etc
passwords are "shared secrets" ... and as such have a horrible scaling
problem ... since the security requirement is that the same "shared
secret" can't be used in different security domains .... leading to
situations where people have tens if not hundreds of shared secrets
that are impossible to remember.
it is possible to substitute public keys in place of passwords and
perform digital signature authentication .... eliminating the problem
with humans having to remember hundreds of different shared secrets.
The very straight forward process is to register public keys in lieu
of registering passwords and perform digital signature authentication
in lieu of password comparison. This has the advantage of maintaining
all the existing business processes while addresses the extremely
significant human factors problems associated with shared secrets.
However, most people have been exposed to public keys and digital
signature authentication in the context of certificates, certification
authorities and PKIs. A horrendous problem with the PKI scenario is
that it creates significant new business processes and security
operations. Nominally, certication authorities were invented to insert
a "certification authority" inbetween the normal "relying party"
(entity checking the password) and "key owner" (entity supplying the
password) ... to address situations where there was no prior
relationship between the "relying party" and the "key owner" ... and
the "relying party" had no realtime/online access to the certificaiton
authority (aka the "letters of credit" model from the days of sailing
ships).
In situations where there is existing business relationship between
the "relying party" (aka entity checking the password) and the "key
owner" (entity supplying the password), it is trivial to show that the
changes necessitated by a certification authority are redundant and
superfluous (not to mention typically unnecessary, complex, and
expensive).
Simple public key upgrade of existing authentication processes
(besides SSH) are public key authentication by radius:
http://www.garlic.com/~lynn/subpubkey.html#radius
with example at:
http://www.asuretee.com
and kerberos pkinit
http://www.garlic.com/~lynn/subpubkey.html#kerberos
internet draft that specifies certificate-less public key operation.
other generalized comments about public key certificate-less operation
for maintaining existing business processes while changing technology
from shared-secret paradigm to non-shared-secret paradigm
http://www.garlic.com~lynn/index.html#aads
some discussion of relying-party-only certificates (common method of
intergrating PKI-based operations into existing business process)
being redundant and superfluous:
http://www.garlic.com/~lynn/subpubkey.html#rpo
misc pieces of recent threads related to the subject:
http://www.garlic.com/~lynn/aadsm15.htm#1 invoicing with PKI
http://www.garlic.com/~lynn/aadsm15.htm#2 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#3 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#4 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#5 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#7 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#8 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#9 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#10 Is cryptography where security took the wrong branch?
http://www.garlic.com/~lynn/aadsm15.htm#16 End of the line for Ireland's dotcom star
http://www.garlic.com/~lynn/aepay12.htm#22 some X9.59 (and little FSTC) ... from crypto mailing list ... fyi
http://www.garlic.com/~lynn/aadsm15.htm#16 End of the line for Ireland's dotcom star
http://www.garlic.com/~lynn/aepay12.htm#31 End of the line for Ireland's dotcom star
-- Anne & Lynn Wheeler | http://www.garlic.com/~lynn/ Internet trivia 20th anv http://www.garlic.com/~lynn/rfcietff.htm
- Previous message: solaris9000: "How to forced password change via ssh?"
- In reply to: dkoleary_at_attbi.com: "public key vs passwd authentication?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
