[27699] in Kerberos
Re: confusion in ank.
daemon@ATHENA.MIT.EDU (Daniel Kahn Gillmor)
Mon Apr 23 13:09:50 2007
From: Daniel Kahn Gillmor <dkg-mit.edu@fifthhorseman.net>
To: kerberos@mit.edu
Date: Mon, 23 Apr 2007 13:07:05 -0400
In-Reply-To: <20070423155235.GE12578@Sun.COM> (Nicolas Williams's message of
"Mon, 23 Apr 2007 10:52:36 -0500")
Message-ID: <87ps5v3tqe.fsf@squeak.fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Mon 2007-04-23 11:52:36 -0400, Nicolas Williams wrote:
> Password quality policies certainly shouldn't apply to randomly-
> generated keys, but that does not mean that there cannot be a key
> expiration policy.
i agree that it's worthwhile to support expiration policy for
randomly-generated keys. One could even argue for iteratively
applying password-quality policies to randomy-generated keys from a
pragmatic approach:
In the unlikely event the randomly-generated key happens to be
guessable by common tools (dictionary attacks, limited character
classes, etc), it's probably worth generating a new random key. While
this reduces the overall space of possible random keys, it does keep
the random keys out of the (admittedly tiny) space regularly probed by
the most common brute force attackers.
--dkg
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8+ <http://mailcrypt.sourceforge.net/>
iD8DBQFGLOe3iXTlFKVLY2URAmTRAJ9eiJ2qnt5N22NhhMLE+8jQeD9U+QCffrXU
FuRYHsQwMjmsxx+7nDs3PxU=
=MNUn
-----END PGP SIGNATURE-----
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
