Re: OpenSSH Certkey (PKI)

Stephen Frost wrote:
> Greetings,
> 
> Overall I'd like to see OpenSSH support PKI in addition to the existing
> methods.  I'm more keen on it being used for host authentication than
> for user certificates, personally.  I did want to comment on this
> though:

Like I said in another email the PKI support for host authentication is
separate from accepting certificates for user authentication/authorization.

> * Daniel Hartmeier (daniel_at_benzedrine.cx) wrote:
> 
>>+Certkey does not involve online verfication, the CA is not contacted by either
>>+client or server. Instead, the CA generates certificates which are (once)
>>+distributed to hosts and users. Any subsequent logins take place without the
>>+involvment of the CA, based solely on the certificates provided between client
>>+and server.
> 
> 
> Would you consider adding support for OCSP?  I saw alot of
> discussion regarding CRLs (and some of their rather well known
> downsides) but only once saw mention of OCSP, and that with no response.
> While CRLs are useful in some circumstances I believe OCSP is generally
> a better approach.  Ideally, both would be supported.  If I had to pick
> one I'd rather see OCSP than CRL support though.

Nothing precludes an OCSP implementation and it can be easily inserted should
someone write it.  We don't do it because the goal of our OpenSSH PKI is to be
completely self-contained w/o any external dependencies.  Working right out of
the box with minimal configuration effort.  Only security that is easy to use
will get used in a safe way.

-- 
Andre