Re: Insecure WWW Access Authorization Protocol?

• Mail folder: WWW Talk Jan 94-present
• Next message: Dave_Raggett: "Re: The future of meta-indices/libraries?"
• Previous message: John Franks: "Re: The future of meta-indices/libraries?"
• Maybe in reply to: michael shiplett: "Re: Insecure WWW Access Authorization Protocol? "

Errors-To: listmaster@www0.cern.ch
Date: Wed, 16 Mar 1994 17:15:14 --100
Message-id: <199403161610.LAA23924@totalrecall.rs.itd.umich.edu>
Errors-To: listmaster@www0.cern.ch
Reply-To: michael.shiplett@umich.edu
Originator: www-talk@info.cern.ch
Sender: www-talk@www0.cern.ch
Precedence: bulk
From: michael shiplett <michael.shiplett@umich.edu>
To: Multiple recipients of list <www-talk@www0.cern.ch>
Subject: Re: Insecure WWW Access Authorization Protocol? 
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas
Content-Length: 1020

"rm" == Rob McCool <robm@ncsa.uiuc.edu> writes:

rm> Yes, which is why we are changing Mosaic's behavior for PGP/PEM
rm> and, in the future, Kerberos, to not send the request unencrypted
rm> first, but to get the authentication information from the user and
rm> allow the user to force Mosaic to send the request encrypted the
rm> first time.
  Are you looking to make obtaining the authentication information an
automatic procedure based on the server name in URL, e.g, given
http://server.com/..., obtain the public key for server.com using
X.509 certificates to verify the public key; then get the user's
private key somehow? Or will the user always be required to find the
server's public key and to enter information (passphrase, etc.) to get
his private key?

  I don't know the status of the Generic Security Service API
(GSS-API) in the Internet community, but after reading RFC 1509, it
could be a good thing to use the GSS-API in httpd servers/clients
instead of each program reinventing the code.

michael