Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (herse.apache.org: local policy)
Date: Fri, 02 Feb 2007 10:25:36 -0500
From: Jeffrey Hutzelman <jhutz@cmu.edu>
To: Jim Rees <rees@umich.edu>, g.w@hurderos.org
cc: dev@directory.apache.org, krbdev@mit.edu, kerberos@mit.edu,
        Jeffrey Hutzelman <jhutz@cmu.edu>
Subject: Re: One Time Identification, a request for comments/testing.
Message-ID: <AC085DD6D243511BFCDE6008@sirius.fac.cs.cmu.edu>
In-Reply-To: <20070202150508.GB15920@citi.umich.edu>
References: <200701310603.l0V639Iu028764@wind.enjellic.com>
 	<41189CE9-71F0-4602-A290-E708D0D6BF4F@wareonearth.com>
 <20070202150508.GB15920@citi.umich.edu>
Originator-Info: 
 login-token=Mulberry:011vPOaUBbQ90iPkbqCXH+2G1lBZRdJ0dDaPzODHM=;
 token_authority=postmaster@andrew.cmu.edu
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


On Friday, February 02, 2007 10:05:09 AM -0500 Jim Rees <rees@umich.edu> 
wrote:

> So would it be fair say this is sort of like using a smartcard in that you
> need both possession of the token and knowledge of a PIN?  And that the
> KDC guards the PIN against brute force guessing, because each guess
> requires a transaction against the KDC?  So stealing the token gets the
> attacker nothing?

No.  Smart cards are not (generally) simple storage devices.  What guards a 
smartcard PIN against brute force guessing is that you only get a limited 
number of tries before the card locks itself and becomes useless.  And what 
protects the private key is the fact that only the card knows the key, so 
if the card is not physically present (or has been locked out due to too 
many wrong PIN's), it is impossible to perform crypto operations with the 
private key.

What we're talking about here is something completely different.  Yes, you 
need both posession of a physical object and a password.  But the 
similarity ends there.

-- Jeff