Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET.

How could I know an ecommerse site uses SET? Or is it the defacto standard?

How could I explain kerberos from a practical view point

share|improve this question
add comment

2 Answers

1. Kerberos

The best example of explaining Kerberos from a practical viewpoint I've ever come across, is Bill Bryant's Designing an Authentication System: a Dialogue in Four Scenes. Originally intended to provide an understanding of the conceptual ideas in Kerberos, as a way to promote implemenations of KerberosV4, it does a decent job, and is quite amusing if you ask me.


2. SET

SET is not a de-facto standard, although intended and promoted as such during development. Even VISA, one of the sponsors and heavy proponents of SET, now promotes newer and more modern security standards for e-commerce.


3. X.509

The first practical case of X.509 certificates that comes to mind, is the widespread use of SSL/TLS to encrypt data transactions on websites over HTTPS

share|improve this answer
    
I always liked the idea of the e-wallet aspect of SET. Not especially flexible so likely one of several reasons why it wasn't adopted. –  jl01 Feb 8 '12 at 21:53
add comment

Kerberos is a protocol for making authentication servers work. Microsoft's Active Directory uses Kerberos for all authentication purposes, so wherever there are Windows machines "in a domain" (as per Microsoft terminology, and as opposed to a "workgroup") then there is some Kerberos at work. A two-line summary of Kerberos is the following:

Every machine trusts the Kerberos server. The Kerberos server authenticates users, and give them tickets which they then show to the other machines. Tickets are limited in time and scope.

X.509 is a standard format for digital certificates, which bind identities to public keys. X.509 works when applied to a specific domain through a profile; the profile tries to narrow down the wide possibilities of X.509 into a workable set of options. The profile for "the Internet" is RFC 5280 and its most visible and widespread application is the issuance of certificates for SSL servers. Whenever you connect your browser to an https:// Web site, then X.509 certificates are at work.

SET was another X.509 profile. It was rather thorough in that it was making X.509 much more simple, by removing hordes of useless options; and it also defined a few extensions which were generally needed. However, commercial success and scientific rationality have never been the same thing; SET never became a "de-facto standard" and is all but abandoned nowadays.

For teaching material, be sure to read the X.509 style guide from Peter Gutmann. Students love sarcasm and jokes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.