Problem - Kevin Tafuro

Kerberos does assume that the environment in which it operates is insecure. It can
overcome a compromised system or network; however, if the system on which its
central database resides is compromised, the security afforded by Kerberos is seriously
compromised.
We cover authentication with Kerberos in Recipe 8.13. Because of the complexity of
the SSPI API in Windows, we do not cover Kerberos on Windows in this book.
Instead, recipes are available on our web site.
Windows NT LAN Manager (NTLM)
Windows NT LAN Manager is a password-based protocol that avoids sending the
password out over the wire by using a challenge-response protocol, meaning that the
two ends each prove to the other that they have the secret, without someone actually
sending the secret. Therefore, NTLM (which does not itself provide a secure
channel) can be used over an insecure channel. However, it is still subject to a number
of password attacks on the server, particularly because the server must store the
actual password.
Windows uses NTLM for network authentication and for interactive authentication
on standalone systems. Beginning with Windows 2000, Kerberos is the preferred network
authentication method on Windows, but NTLM can still be used in the
absence of a Kerberos infrastructure.
Because of the complexity of the SSPI API in Windows, we do not cover authentication
with NTLM in this book. Instead, recipes are available on our web site.
SSL certificate-based checking
Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), use
certificates to allow entities to identify entities in a system. Certificates are verified
using a PKI where a mutually trusted third party vouches for the identity of a certificate
holder. See Recipe 10.1 for an introduction to certificates and PKI.
Certificates are obtained from a trusted third party known as a certification authority
(CA), which digitally signs the certificate with its own private key. If the CA is
trusted, and its signature on the certificate is valid, the certificate can be trusted. Certificates
typically also contain other important pieces of information that must also
be verified—for example, validity dates and the name of the entity that will present
the certificate.
To be effective, certificates require the mutually trusted third party. One of the primary
problems with certificates and PKI is one of revocation. If the private key for a
certificate is compromised, how is everyone supposed to know that the certificate
should no longer be trusted? CAs periodically publish lists known as certificate revocation
lists (CRLs) that identify all of the certificates that have been revoked and
should no longer be trusted, but it is the responsibility of the party verifying a certificate
to seek out these lists and use them properly. In addition, there is often a signifi-
Choosing an Authentication Method | 371
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.