HDTenEightyP/NetNews huggingface dataset:
From: kaufman@kibitz.enet.dec.com (Charlie Kaufman)
Subject: Re: Kerberos/PK and SecurID ??
Organization: Internet-USENET Gateway at Stanford University
Date: Mon, 5 Oct 1992 23:01:17 GMT

>There has been some mention of a mythical beast called Kerberos/PK (Public
>Key).
>
>Does anyone know anything about this - like:
>
> - does it exist (perhaps under another name)
> - who is developing / implementing it

There may be multiple efforts vaguely fitting this description, though
I've never heard the name Kerberos/PK used.

DASS/SPX is a design/model implementation of a public key based
authentication protocol loosely modelled after Kerberos V4.  SPX code
is available by anonymous ftp, but unfortunately like Kerberos it is
not exportable and unfortunately unlike Kerberos there is no "Bones"
version.  The DASS spec has timed out as an internet draft; we're
trying to figure out the appropriate way to make it available again in that context.

There were discussions early this year in the context of the IETF-CAT
working group about merging the DASS and Kerberos V5 designs into an
"IAM" (Internet Authentication Mechanism) supporting either public or
secret key technology.  While all participants remain enthusiastic
about the technical viability of such an approach, I believe it has
fallen victim to competing priorities at least for the moment (someone
please correct me if there is progress I haven't heard about).

There is a group in Europe called SESAME that is working on a public
key based enhancement to OSF-DCE security that may offer some of the
properties of a public key based Kerberos.  A working prototype of
SESAME exists, but neither code nor spec are readily available.

And there may be yet other such efforts, either clandestine or that I
simply haven't heard about.


>Also, does anyone have contact details for the group involved with Kerberos
>and SecurID?

There may be multiple efforts here as well.  I have been working with
Jim Kotanchik of Security Dynamics (1-617-354-8836) on ways of
integrating SecurID with Kerberos.  Unfortunately, he is not on the
net.  I don't feel free to discuss the protocol, and I don't know what
their plans are for deploying it, but he gave me permission to give out
his name.  I expect they are planning to go public with their proposal
at some point, but I don't know whether it will be through MIT or through OSF.

He also mentioned that there exists at least one third party product
today that integrates Kerberos with SecurID cards and that "any SecurID
salesman" could point you to it.

	--Charlie Kaufman
Newsgroups: comp.protocols.kerberos
From: warlord@ATHENA.MIT.EDU (Derek Atkins)
Subject: rkinit source (was Re: Ticket Forwarding)
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 1 Oct 1992 22:21:36 GMT

Ok.  I have tarred up the current source for rkinit and rkinitd.
They are currently available via anonymous ftp from:

	toxicwaste.mit.edu:/pub/archive/kerberos/rkinit.tar.Z

There might be some problems with the Imakefiles.  If I remember
correctly they depend upon the Athena building environment.  So,
you might have to create Makefiles or fix the Imakefiles yourself.

Enjoy!

-derek

         Derek Atkins -- MIT '93 -- Electrical Engineering
--warlord@MIT.EDU | ..!mit-eddie!mit-athena!warlord | s20069@mitvma.bitnet
      Chairman, MIT Student Information Processing Board (SIPB)
           MIT Media Laboratory, Speech Research Group
Newsgroups: comp.protocols.kerberos
From: bbh7rqj@SOCRATES.MIT.EDU
Subject: Possible incorrect Pepsy flags?
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 2 Oct 1992 19:54:33 GMT

Hello,

I found that my version of pepsy doesn't like the -C option which
Project.tmpl passes it.  

I took it out, but am weary of something happening down the road...

Is this flag really supposed to be there, or is it a mistake, or do 
I need a newer version of pepsy?

Thanks,
Chris.
-- 

*******************************************************************************

Chris Davies	                        e-mail: cdavies@socrates.bell-atl.com
Bell Atlantic                            Voice: (301) 989-4111
                                           Fax: (301) 595-1341


Note: If your e-mail reply to me bounces, try sending it explicitly to 
cdavies@socrates.bell-atl.com instead of using the 'reply' feature.
******************************************************************************
Newsgroups: comp.protocols.kerberos
From: sjogren@TGV.COM (Sam Sjogren)
Subject: Kerberos interoperability demonstration
Organization: Internet-USENET Gateway at Stanford University
Date: Tue, 29 Sep 1992 18:18:51 GMT

Greetings!

At Interop (next month, last week of October, in San Francisco)
there will be a multi-vendor, multi-platform, demonstration of
Kerberos on the show's network.  We are looking for additional
vendors to participate in this technology demonstration.  If you
have a working implementation that is available commercially and
are interested in participating, please send email to sjogren@tgv.com
(sam@tgv.com also works, if you forget how to spell my last name).

Cheers,
-Sam
From: looi@qut.edu.au
Newsgroups: comp.protocols.kerberos
Subject: Kerberos/PK and SecurID ??
Date: 30 Sep 92 08:08:08 EST
Organization: Queensland University of Technology

There has been some mention of a mythical beast called Kerberos/PK (Public
Key).

Does anyone know anything about this - like:

 - does it exist (perhaps under another name)
 - who is developing / implementing it

Also, does anyone have contact details for the group involved with Kerberos
and SecurID?

Mark
---------------------------------------------------------------------------
Mark H Looi, Information Security Research Centre, Gardens Point Campus
Queensland University of Technology, GPO Box 2434, Brisbane 4001, Australia
Tel:(07)864-1199     e-mail:m.looi@qut.edu.au, mlooi@fitmail.fit.qut.edu.au

Newsgroups: comp.protocols.kerberos
From: linn@albeit.enet.dec.com (John Linn. LKG1-2/A19. {-486 or DTN 226}-7384.  02-Oct-1992 0910, 508)
Subject: Kerberos V5 ASN.1 observation
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 2 Oct 1992 13:08:00 GMT

Charlie Kaufman writes:

>In looking at the ASN.1 for Kerberos V5, it appears that the data
>structures could be made much more compact through liberal use of
>IMPLICIT to get rid of extra tags.  Not being an ASN.1 expert, I'm
>wondering whether IMPLICIT is the default given the tools you are using. (?)

In looking at the Kerberos V5 ASN.1 and the tagging employed therein, I
observed a property which I found desirable, though I'm not sure whether
it was explicitly intentional or arose by fortutious coincidence.  Since
Kerberos V5 tokens all carry [APPLICATION xx] tags, where xx is
non-zero, it's always possible to distinguish a "bare" Kerberos token
from the beginning of a token which is wrapped along with a mechanism
type Object Identifier per GSS-API (Internet-Draft
draft-ietf-cat-genericsec-02) Appendix B, where the first token of a
context establishment sequence is tagged as follows: 

InitialContextToken ::=
[APPLICATION 0] IMPLICIT SEQUENCE {
	thisMech	MechType	-- MechType is OBJECT IDENTIFIER
	innerContextToken ANY DEFINED BY thisMech
		-- contents mechanism-specific
	}

thereby yielding a BER with a first octet of:

60	-- Application, Constructed, Tag=0

distinguishable from a Kerberos V5 token sans wrapper.  I believe that
it would be a Good Thing to assure that any future changes to the
Kerberos or GSS-API ASN.1 preserve this disambiguation property.

--jl
Newsgroups: comp.protocols.kerberos
From: greg@DUKE.CS.UNLV.EDU (Greg Wohletz)
Subject: setting up inter-realm authentication
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 1 Oct 1992 23:33:55 GMT


For many months I've  been  trying to go  about setting up inter-realm
authentication between UNLV and MIT, however I  can't seem to  get any
response  from  anyone  on  the other end of  network-request@mit.edu,
perhaps  the person  actually  responsible  for such things reads this
list and can let me know who he/she is.

					--Greg
Newsgroups: comp.protocols.kerberos
From: dean@ksr.com
Subject: Re: Ticket Forwarding
Organization: Internet-USENET Gateway at Stanford University
Date: Wed, 30 Sep 1992 19:12:11 GMT

I am considering an extension in which a client could request a  
ticket for the remote host to which the user wants to pass the  
ticket.  


The kerberos server would send back a tgt for that host (say for  
principal user.tkp). Kerberized ticket passing rlogin authenticates  
itself as usual and would pass this ticket and session key (encrypted  
in the session key for the rcmd.remotehost) to the remote rlogind.   
The rlogind then decrypts the ticket and creates a ticket file using  
the session key and ticket just passed.

Services that use lib acl (or just look at the user and instance of  
the ticket) for authorization would be able to discriminate "real"  
tickets from passed tickets by looking at the instance.

Of course, these passed tickets and keys could be stolen if the  
/etc/srvtab on the remote host has been compromised. But if this is  
the case, then any tickets aquired on that host can also be stolen  
from the users ticket file.

Turning off checking of the host address permits stolen tickets to be  
used from anywhere.  Tickets can still be stolen from the ticket  
file, but they can only be used from that machine.

While my scheme presents the possiblity of using a stolen ticket to  
get a ticket passing ticket for another machine, it can control the  
extent of the damage by being able to specify whether passed tickets  
can be trusted.    It does not change the faked rlogin threat, but it  
does make the use of kerberized network services much more  
convenient, which hopefully improves the overall security of the  
network.



Dean Anderson
KSR Computing Facilities
Kendall Square Research
Newsgroups: comp.protocols.kerberos
From: schoultz@admin.kth.se (Rickard Schoultz)
Subject: Mac/PC/terminal server klogin clients?
Organization: Royal Institute of Technology, Sweden
Date: Tue, 29 Sep 1992 11:34:41 GMT


 Does anyone have any pointers to commercial/share/freeware kerberos
klogin clients for Macs, PCs or terminal servers? I noticed that 
PC/TCP 2.1 comes with some kerberos support, and I would love to see
that on Macs and terminal servers.

If you please could mail me what you know, I will post a summary.

Regards/Rickard

-- 
Rickard Schoultz			Internet: schoultz@admin.kth.se
KTH - TS/Data				+46-8-790 90 88   (voice)
S-100 44 Stockholm (SWEDEN)	    	+46-8-10 25 10    (fax)
Newsgroups: comp.protocols.kerberos
From: ccx009@cch.coventry.ac.uk (Adam Bentley)
Subject: Kerberised ftp?
Followup-To: poster
Organization: Coventry University
Date: Wed, 30 Sep 1992 09:21:59 GMT


I'm resending this request as I think it got lost somewhere....

Does anyone have a kerberised ftp/ftpd for 4.2 bsd?

thanks.


-- 
						_
					       /-\dam

FLESH: Adam Bentley (Fraggle), Systems/Networking, Coventry University. UK
From: Christian.Huitema@sophia.inria.fr (Christian Huitema)
Subject: Re: Question about IFIP Conference
             <9209240513.AA16214(a)sorel.kotel.co.kr>
Newsgroups: comp.protocols.iso.x400
X-Mts: smtp
Date: 28 Sep 92 13:24:30 GMT

The next IFIP WG-6.5 conference is planned for May 94 (not 93!) in
Barcelona, Spain. The CFP is not yet published. The dead line
for submissions is not yet fixed; a date like November or December 93 is
probably reasonable.

Christian Huitema
Newsgroups: comp.protocols.iso.x400
From: hph@gandalf.uio.no (Hans Petter Holen)
Subject: What is X.440 dealing with ?
Reply-To: H.P.Holen@usit.uio.no
Organization: University of Oslo
Date: Tue, 6 Oct 1992 16:48:25 GMT

Subject says it all...
-- 
Hans Petter Holen
Centre for Information Technology Services, University of Oslo, Norway
From: hta@boheme.er.sintef.no (Harald Tveit Alvestrand)
Subject: Re: X.400 Monitoring & Fault Diagnostics
Reply-To: harald.alvestrand@delab.sintef.no
Organization: SINTEF DELAB, Norway
Date: Tue, 6 Oct 92 21:29:24 GMT

I was just at the ISO SC18 WG4 SWG MHS (horrible name:-) in Oslo.
There was a special working group on management, which many people seemed
to think was terribly important.

Unfortunately, the group seemed to try to do both "managing the MHS" and
"managing other things using MHS to carry management information".
Both projects seemed to be going slowly. But I may have overlooked something
- I was unable to attend most of the management session, and carried away
only 15 centimetres (LITERALLY) of paper, out of the 30 or so distributed.

-- 
                   Harald Tveit Alvestrand
Harald.Alvestrand@delab.sintef.no
C=no;PRMD=uninett;O=sintef;OU=delab;S=alvestrand;G=harald
+47 7 59 70 94
Newsgroups: comp.protocols.iso.x400
From: mskuhn@immd4.informatik.uni-erlangen.de (Markus Kuhn)
Subject: Re: Wanted: X.400 protocol spec
Reply-To: mskuhn@immd4.informatik.uni-erlangen.de
Organization: CSD., University of Erlangen, Germany
Date: Thu, 1 Oct 1992 18:02:45 GMT

perry@bluemtn.COM (Perry Minyard) writes:

>I called Omnicom, and they have what they call the F.400 spec.  The person
>told me that X.400 was replaced by F.400.  Can anybody give me more detail?
>I want to make sure that I'm getting the right thing before I spend the cash.

The 1988 CCITT Blue Book contains both the X.400 and the F.400
series of recommendations. X.400 defines the OSI protocol for e-mail
completely and F.400 contains a few additional service definitions,
e.g. maximum delivery times withing ADMDs for various priority levels
etc. So you will probably be interessted in both.

BTW: The 1992 recommendations are said to be already at the printer,
so if I were you I'd wait a few months and would buy the hopefully
much more bug cleaned revised version!

Markus

-- 
Markus Kuhn, Computer Science student -=-=- University of Erlangen, Germany
Internet: mskuhn@immd4.informatik.uni-erlangen.de  |  X.500 entry available
-A distributed system is one in which the failure of a computer you didn't-
-even know existed can render your own computer unusable. (Leslie Lamport)-
Newsgroups: comp.protocols.iso.x400
From: dearnshaw@worldbank.org (Darrell Earnshaw)
Subject: X.400 Monitoring & Fault Diagnostics
Organization: The World Bank
Date: Wed, 30 Sep 1992 14:53:12 GMT

The Bank is in the process of implementing an X.400 messaging backbone within
the organization. We currently have a Network Operations Center, whose job is
to monitor the Bank's campus and global networks in real-time, and to provide
1st-level fault isolation. It looks like the NOC will be assigned the
responsibility for monitoring the X.400 system.

The question is, does anyone know of tools to accomplish this? Has the CCITT
specified a monitoring/fault-finding tool/specification for X.400 based
systems. (I'm assuming that the supporting OSI layers are monitored using other
tool.) What are the experiences of others who are in the business of providing
X.400 services?

-- Posts or mail would be appreciated. Thanks.

-- Darrell Earnshaw
 
Newsgroups: comp.protocols.iso.x400
From: eskovgaa@cue.bc.ca (Erik Skovgaard)
Subject: Re: Wanted: X.400 protocol spec
Newsgroups: comp.protocols.iso.x400
Date: 2 Oct 92 15:45:10 GMT

Perhaps the confusion is that there won't be an X.400 in 1992!
In 1988, X.400 and F.400 were the same, but as I understand it, they
will not issue X.400 this time.

X.402 and the rest of the series (plus X.435 and X.440) will be there,
of course.

Cheers,                                        ....Erik.
From: eskovgaa@cue.bc.ca (Erik Skovgaard)
Subject: Interop - free
Newsgroups: comp.protocols.iso.x400
Date: 28 Sep 92 23:10:45 GMT

I have a bunch of free passes for Interop '92 (Fall) 28-30 October, 1991
that I am willing to give away.  The passes gives access to the exhibition
only.

To get a pass, send me your postal mailing address EXACTLY AS IT SHOULD
APPEAR ON THE ENVELOPE and I will mail out my stock of 65 passes on a first
come, first serve basis.

Cheers,                             ....Erik.
From: perry@bluemtn.COM (Perry Minyard)
Newsgroups: comp.protocols.iso.x400
Subject: Re: Wanted: X.400 protocol spec
Date: 29 Sep 92 20:07:41 GMT
Article-I.D.: bluemtn.1992Sep29.200741.24167
Reply-To: perry@bluemtn.COM (Perry Minyard)
Organization: blue mountain software

In article <9209251752.AA24533@gateway.mitre.org> kit@gateway.mitre.org (Kit Lueder) writes:
>For any standards documents, they used to be available from
>Omnicom. Phillips Publishing bought out the document distribution
>services from Omnicom, but I think that 1-800-OMNICOM still works
>(but is answered by Phillips people).
>The latest info I have for Phillips is:
>7811 Montrose Rd, Potomac, MD 20854, Phone: 301-340-2100, Fax: 301-424-4297.

I called Omnicom, and they have what they call the F.400 spec.  The person
told me that X.400 was replaced by F.400.  Can anybody give me more detail?
I want to make sure that I'm getting the right thing before I spend the cash.

By the way, Omnicom sells their "F.400" for $52.   ANSI sells the X.400
for $87.



-- 
*----*----*----*----*----*----*----*----*----*----*----*----*----*----*----*
| A mind is a terrible thing to taste.  0 0  | perry@bluemtn.com           |
| Oh yes!  I feel it now.. I'm ZANGIN!   V   | 71020.3073@compuserve.com   |
*----*----*----*----*----*----*----*----*----*----*----*----*----*----*----*
From: ziegast@rodan.UU.NET (Eric W. Ziegast)
Newsgroups: comp.protocols.iso.x400
Subject: Re: Lack of openness of OSI info.
Date: 26 Sep 1992 15:24:19 -0400
Organization: UUNET Technologies, though I do not speak for them
Distribution: world
Reply-To: ziegast@uunet.uu.net (Eric W. Ziegast)
NNTP-Posting-Host: rodan.uu.net

Disclaimer:  I'm someone who lives in the TCP/IP world and prefers
  TCP/IP to other types of networking.  I was once interested in
  OSI and X.400 (especially PP), but was discouraged by its size and
  complexity.  I have not had an opportunity to review the standards
  themselves.  My bias against OSI may show.


The OSI standards are open (in my opinion) because anyone can use
those standards through products developed by independent vendors
that are based on the OSI standards.  The OSI people (CCITT?) do not
charge an end user or organisation for using their standards.  The
vendors who make OSI-based products are free to compete with each
other based on the merits of their software (or hardware).

Should the standards be distributed for free?  That is a matter of
opinion.  My opinion:  If the OSI standards were not restricted in
their distribution and were freely available to the public, there
would be more people who would understand how they work and might
use them or even develop software for them.  Then again, the OSI
people have a right to recover charges and expenses for their dis-
tribution of the standards.  Whether they should be allowed to have
a monopoly on the distribution depends, in part, on how they are
funded.

How are the creation of OSI standards funded?  If my tax dollars
(or francs, pounds, marks, etc.) went into the development of those
standards, I don't see why I should have to pay to get them.

BTW: I'm sure that more than a few trees would be spared if the
     standards were distributed or made available electronically.


proyse@peeras.demon.co.uk (Phil Royse) writes:
> It appears not to be insisting too strongly, and govt. departments on tight
> budgets, who don't actually CARE (except that they want low cost workable
> "open" systems), are continuing to buy TCP/IP.  They are allowed to do so by
> invoking the "derogation" of "operational continuity" and having a "strategy"
> on file which says "we plan to migrate to OSI ... waffle waffle..."

One way they can better state their case is to say they're buying
TCP/IP and plan to layer OSI protocols (like X.400/X.500) on top of
it.  By chosing this path they get to use the best of both worlds
and not be trapped in one or the other.

The TCP/IP world has alot to offer.  Why should organisations choose
only OSI protocols?  ("Because they are standards" does not count.)
--
Eric Ziegast
ziegast@uunet.uu.net
From: S.Kille@isode.com (Steve Hardcastle-Kille)
Subject: A very nasty typo
In-reply-to: Your message of Mon, 05 Oct 92 11:27:52 +0100. <9210051527.AA02729@spyder.ssw.com>
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Newsgroups: comp.protocols.iso.x400.gateway
Date: 6 Oct 92 22:19:18 GMT
Phone: +44-71-223-4062

Robert,

You are quite right that this is a problem.   However, the difficulty
is that there is a typo in RFC 1327.  The value of the UCL OID is
correct in other places (e.g., RFC 1274).

The OID component should be (19200300) and not (234219200300)

This clearly needs fixing.   I'm assuming that there will be a revised
1327 at some stage fairly soon in order to fold in the MIME-MHS
changes.   I'd propose waiting until then, rather than reissue for a
single typo.  However, I'm happy to take advice on this.

Another solution would be to shift to a less perverse OID.    (e.g.,
IANA or Enterpise assigned).


Steve

 >From:  "Robert S. Miles" <rsm@spyder.ssw.com>
 >To:    Steve Hardcastle-Kille <S.Kille@isode.com>
 >Subject: Re: RFC-1327 OIDs
 >Date:  Mon, 05 Oct 92 11:27:52 +0100

 >I wish I were wrong, but I believe this is a problem, particularly for
 >compatability with future implementations.
 >
 >	UCL OID element	value (per RFC 1327):			234219200300
 >	Common maximum unsigned integer ((2 ** 32) - 1):	  4294967295
 >	Truncated UCL OID element value (mod (2 ** 32)):	  2290966316
 >
 >Both ISODE and Retix use an array of integers to store OID elements
 >before encoding.  On 32 bit machines this means the OID element value
 >can be truncated.
 >
 >					-Bob
Newsgroups: comp.protocols.iso.x400
From: proyse@peeras.demon.co.uk (Phil Royse)
Subject: Lack of openness of OSI info.
Distribution: world
Organization: Peer Association
Date: Sat, 26 Sep 1992 10:21:12 +0000

Re the message on the lack of OSI standards available over the Internet:

Yes it is perverse that OSI standards are not as freely available as
all other docs, files, code etc. (especially RFCs) are over the Internet.

We are now ten years down the OSI track and very few systems use it other 
than a few govt. sponsored demonstrator projects.  However, all UNIX & TCP/IP
related products are continuing to sell very well, and build up a base.

This lack of information is undoubtedly inhibiting the progress towards
OSI, and allowing TCP/IP (etc., inc SNMP, FTP) to gain a massive
market. (specifically transport & network layers  -  X.400's OK!)

However, many organisations see OSI as a means of making money, whereas
the internet's philosophy is "to connect computers together...."
These widely differing motivations will eventually become apparent...

In the UK the Treasury is the "custodian" of OSI (through the CCTA and GOSIP).
It also has powers to terminate IT procurements which do not adhere to
EC/87/95 the European Commission's decision to insist on OSI appearing
in procurement specs. for public sector IT purchases.

It appears not to be insisting too strongly, and govt. departments on tight
budgets, who don't actually CARE (except that they want low cost workable
"open" systems), are continuing to buy TCP/IP.  They are allowed to do so by
invoking the "derogation" of "operational continuity" and having a "strategy"
on file which says "we plan to migrate to OSI ... waffle waffle..."

Before long, there will be so many TCP/IP-capable systems operational in 
govt departments (and the private sector for that matter) that to convert to
OSI for transport/network layers will be a massive and expensive excercise.

One must question whether any organisation is ever going to undertake this 
conversion....


--
Phil Royse   Comms Consultant, Purley   |  Mail brought to you by PCElm 3.01.
            Surrey UK (+44)81 645-9868  |
Newsgroups: comp.protocols.iso.x400