[Prev][Next][Index][Thread]
RE: CompuServe Positions on Passphrases and TLS
>From: Rohit Khare[SMTP:khare@w3.org]
>
>From an architectural standpoint, I thought the issue instead was:
>What the !#$%@ are application-level authentication concepts doing in
>a transport-level confidentiality protocol?
>
If authentication is an "application-level" concept unfit for the TLS
layer, then most of the TLS handshake should be thrown away, since it
deals largely with authentication. Personally, I consider
authentication to be far too sensitive a task to trust to applications.
(Then again, I also consider authorization to be far too sensitive a
task to trust to applications; how many operating systems, after all,
treat file access control as an application-level matter?) But
regardless of where you think authentication should go, passphrase-based
authentication should obviously be in the same place as public-key-based
authentication, since they both perform the same function.
As for authorization, the only people I can think of who are trying to
slip authorization into TLS are pushing attribute certificates, not
passphrase authentication.
Daniel Simon
Cryptographer, Microsoft Corp.
dansimon@microsoft.com
>
Follow-Ups: