I was talking to somebody in the CISCO booth today about digital signature authentication in a RADIUS environment and they suggested that a good forum for the question would be here ... as to whether anybody at Cisco would be interested in deploying such an enhanced RADIUS product
Every since having done some electronic commerce work in the early '90s, I've been looking at making it more secure; basically pushing strong authentication further and further into the business processes.
http://www.garlic.com/~lynn/aadsm5.htm#asrn2
http://www.garlic.com/~lynn/aadsm5.htm#asrn3
One of the things that I started to notice was that Certificates tended to replicate a small subset of information that was maintain in real time in business account records. Besides certificates being stale information they might unnecessarily divulge information that wasn't required in the business context (i.e. name and address in identity certificates when name and address was not necessary).
As part of that effort, it became very apparent that many business contexts would be better served with public keys registered in account records.
Work has been done on a passed financial standards that provides digital signature authentication (w/o requiring certificates) for all account-based retail payments)
http://webstore.ansi.org/ansidocstore/product.asp?sku=DSTU+X9%2E59%2D2000
we've looked at applying a similar paradigm to internet authentication; specifically looking at adding public key registration to RADIUS capability and RADIUS performing digital signature authentication using public key in the RADIUS database (in lieu of a certificate).
Furthermore, web server client authentication could similarly be done with a web servers supporting RADIUS and RADIUS digital signature authentication (not just for modem pool concentrator session connection). The benefit to some large ISP/webhoster is that they could have a single common administrative interface for managing all authentication information and allowing on a client and/or account basis an expanded choice of authentication paradigms integrated into a single common (existing) infrastructure.
In general this digital signature model is discussed in various forms at:
http://www.garlic.com/~lynn/
some RADIUS specific discussion from past newsgroups
http://www.garlic.com/~lynn/2000b.html#14
http://www.garlic.com/~lynn/2000b.html#46
http://www.garlic.com/~lynn/2001d.html#20
http://www.garlic.com/~lynn/2001d.html#46
