[27324] in Kerberos
Re: One Time Identification, a request for comments/testing.
daemon@ATHENA.MIT.EDU (Andrew Bartlett)
Wed Jan 31 16:51:44 2007
From: Andrew Bartlett <abartlet@samba.org>
To: Nicolas Williams <Nicolas.Williams@sun.com>
In-Reply-To: <20070131211706.GM28618@binky.Central.Sun.COM>
Date: Thu, 01 Feb 2007 08:21:49 +1100
Message-Id: <1170278509.8708.18.camel@amy.samba4.abartlet.net>
Mime-Version: 1.0
Cc: dev@directory.apache.org, Sam Hartman <hartmans@mit.edu>, g.w@hurderos.org,
krbdev@mit.edu, kerberos@mit.edu
Content-Type: multipart/mixed; boundary="===============0268727365=="
Errors-To: kerberos-bounces@mit.edu
--===============0268727365==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="=-F9AiROqbgb8JfSVA0IR5"
--=-F9AiROqbgb8JfSVA0IR5
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
On Wed, 2007-01-31 at 15:17 -0600, Nicolas Williams wrote:
> On Thu, Feb 01, 2007 at 07:51:47AM +1100, Andrew Bartlett wrote:
> > I think developing a cross-platform USB 'tumb drive' based soft token
> > would be an immense benefit. It could make PKINIT real for many small
> > sites that do not yet wish to invest in a token stack, and perhaps more
> > importantly, make PKINIT and smart-card login something that developers
> > and interested technical users can test with resources to hand.
>=20
> What do you mean by "cross-platform"?
Works with windows desktops too :-)
> OpenSolaris has an OSS (CDDL'ed) PKCS#11 softtoken provider that does
> pretty much what you want. It stores its files in a filesystem, by
> default in a sub-directory of the user's home directory; filesystem type
> does not matter. Since you can put filesystems on a USB flash drive
> that should suffice for a "cross-platform" softtoken.
>=20
> The specifics of the Solaris softtoken's directory layout and file
> formats are project private interfaces IIRC, but if there's interest I
> imagine that we could document them, make them committed public
> interfaces and help establish a standard for a cross-platform softtoken.
Love also has a PKCS#11 softtoken. The details that I think might need
work are integration so that the logon systems on various platforms
'know' that the token is there, and the softtoken driver should be used.
Andrew Bartlett
--=20
Andrew Bartlett <abartlet@samba.org>
--=-F9AiROqbgb8JfSVA0IR5
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQBFwQhtz4A8Wyi0NrsRAvtdAKCaVDK5t9mXYLV4TR70dh+2Ctd//ACgg5Uo
g3NSBFZJB4n49VTDmYKiYis=
=qUhv
-----END PGP SIGNATURE-----
--=-F9AiROqbgb8JfSVA0IR5--
--===============0268727365==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0268727365==--
