Subject: RE: Using "Cookies"?

From: "Friedrichs, Paul LCDR" <[email-masked]>
Date: Thu, 26 Apr 2001 16:28:34 -0400

Mike, 

That's what I meant. Perhaps I wasn't clear. But it would still seem to
require modification at the browser. Even if the first SSL server captured
the SSL session key and placed it in the (encrypted) cookie, and the second
web server knew how to decrypt the cookie and use the session key for SSL,
the SSL client would not expect to be able to use the same key with the
second SSL server. (Also, this would require the sharing of the same session
key across several applications.) Or were thinking of some other
possibility?

In any case, I was using it as something of a metaphor to better understand
where today's cookie-based systems might (must?) fall short. (This wouldn't
mean they shouldn't be used if there is no viable alternative.)

Thanks,

Paul

> -----Original Message-----
> From: Mike Fisk [mailto:[email-masked]]
> Sent: Thursday, April 26, 2001 3:38 PM
> To: Friedrichs, Paul LCDR
> Cc: 'Jeffrey Hutzelman'; Derek Atkins; Bernard Aboba; [email-masked];
> Jung Edward; [email-masked]
> Subject: RE: Using "Cookies"?
> 
> 
> On Thu, 26 Apr 2001, Friedrichs, Paul LCDR wrote:
> 
> > If the above is correct, perhaps the way to kluge Kerberos 
> rigor into
> > web-based systems would involve something like having the 
> (well) encrypted
> > cookie contain the SSL/TLS session key that would be used 
> by the user and
> > application.
> 
> That would seem to require a modified browser.  Try having 
> the ticket and
> plaintext session key in the cookie and protecting it with SSL.
> 
> -- 
> Mike Fisk, RADIANT Team, Network Engineering Group, Los 
> Alamos National Lab
> See http://home.lanl.gov/mfisk/ for contact information
> 
>