[krbdev.mit.edu #8656] Implement client optimistic SPAKE, perhaps by default

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[krbdev.mit.edu #8656] Implement client optimistic SPAKE, perhaps by default

Jeffrey Arbuckle via RT
Optimistic SPAKE might not be completely safe in scenarios like the
following: a KDC offers PKINIT and 1FA SPAKE for a principal, the
former providing either a more convenient passwordless login experience
or a more generous authentication indicator, the latter being a
fallback option for devices that don't possess the client certificate.  
If the client does optimistic SPAKE, it won't learn about the KDC's
offer of PKINIT, and will ask for the password and/or settle for not
getting the PKINIT auth indicator.

So perhaps explicit configuration should be required for the client to
use optimistic SPAKE.
_______________________________________________
krb5-bugs mailing list
[hidden email]
https://mailman.mit.edu/mailman/listinfo/krb5-bugs