Differences between revisions 3 and 4
⇤ ← Revision 3 as of 2006-03-22 16:40:56 →
Size: 2374
Editor: WolfgangFriebel
Comment:
← Revision 4 as of 2006-03-22 18:08:22 → ⇥
Size: 3347
Editor: WolfgangFriebel
Comment: start pki
Deletions are marked like this. Additions are marked like this.
Line 6: Line 6:
Needs a third party to establish a trust relation. In High energy Physics Kerberos4 Needs a third party to establish a trust relation. In High energy Physics (HEP) Kerberos4
Line 22: Line 22:
 * LAL (Apr 01) [http://events.lal.in2p3.fr/conferences/HEPIX/presentations/Tuesday/Kaletka-W2000-Kerberos.ppt M.Kaletka: W2000 Kerberos Experience]
Line 36: Line 37:
=== Public key infrastructure === === Authentication using public key infrastructure ===

Public key cryptography is an assymetric key method. It uses a pair of keys, called public and private key. The public key is intended for distribution, while the private key needs to be kept secret. Both keys are connected through a mathematical relation, which is highly asymmetric in terms of computational effort to derive one key from the other.

Knowing the public key it should be practically impossible to derive the private key.

In order to verify that a public key is associated with the real issuer, a public key infrastructure (PKI) is installed. In most practical cases within HEP the keys used are so called '''X.509 Certificates'''. The verification of these certificates is done trough a hierarchy of trusted third parties, called '''Certification Authorities''' (CA).

Authentication technologies

Authentication using symmetric key cryptography

Key for encryption and decryption is the same (or easily derived from the other key). Needs a third party to establish a trust relation. In High energy Physics (HEP) Kerberos4 and Kerberos5 are used. Kerberos4 has security flaws and is largely replaced by Kerberos5.

Kerberos5

Defined in [http://www.ietf.org/rfc/rfc4120.txt RFC4120], API defined in [http://www.ietf.org/rfc/rfc4121.txt RFC4121]

Currently implemented in 3 major variants: MIT Kerberos, Heimdal Kerberos, Windows Kerberos

Software with Kerberos Support

Usually the software mentioned below does not come with Kerberos support by default, configuration or recompilation is required in most cases.

  • Webserver: IIS, Apache (so called Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO) support)
  • Webclients: Internet Explorer, Mozilla, Firefox
  • Mailserver: Cyrus-IMAP, UW-IMAP
  • Mailclients: pine, Mozilla, Thunderbird

  • Batchsystems: SunGridEngine, LSF

  • Filesystems: AFS, NFSv4

  • Libraries: PAM, GSSAPI ([http://www.ietf.org/rfc/rfc1508.txt version 1] and [http://www.ietf.org/rfc/rfc2743.txt version2]), [http://www.ietf.org/rfc/rfc2222.txt SASL], perl Modules(Authen-SASL, Authen-Krb5)

  • Protocols: LDAP, IMAP, SMTP (via SASL) Socks5
  • Client/Server programs: openssh, telnet, ftp, su, arc, arcx

Other UNIX software is or could be made Kerberos5 aware by using the SASL or GSS API.

Authentication using public key infrastructure

Public key cryptography is an assymetric key method. It uses a pair of keys, called public and private key. The public key is intended for distribution, while the private key needs to be kept secret. Both keys are connected through a mathematical relation, which is highly asymmetric in terms of computational effort to derive one key from the other.

Knowing the public key it should be practically impossible to derive the private key.

In order to verify that a public key is associated with the real issuer, a public key infrastructure (PKI) is installed. In most practical cases within HEP the keys used are so called X.509 Certificates. The verification of these certificates is done trough a hierarchy of trusted third parties, called Certification Authorities (CA).

DVInfo/Authentication_technologies_in_use_at_HEP (last edited 2008-10-30 11:40:12 by localhost)