I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET.

How could I know an ecommerse site uses SET? Or is it the defacto standard?

How could I explain kerberos from a practical view point


1. Kerberos

The best example of explaining Kerberos from a practical viewpoint I've ever come across, is Bill Bryant's Designing an Authentication System: a Dialogue in Four Scenes. Originally intended to provide an understanding of the conceptual ideas in Kerberos, as a way to promote implemenations of KerberosV4, it does a decent job, and is quite amusing if you ask me.

2. SET

SET is not a de-facto standard, although intended and promoted as such during development. Even VISA, one of the sponsors and heavy proponents of SET, now promotes newer and more modern security standards for e-commerce.

3. X.509

The first practical case of X.509 certificates that comes to mind, is the widespread use of SSL/TLS to encrypt data transactions on websites over HTTPS

  • I always liked the idea of the e-wallet aspect of SET. Not especially flexible so likely one of several reasons why it wasn't adopted. – jl01 Feb 8 '12 at 21:53

Kerberos is a protocol for making authentication servers work. Microsoft's Active Directory uses Kerberos for all authentication purposes, so wherever there are Windows machines "in a domain" (as per Microsoft terminology, and as opposed to a "workgroup") then there is some Kerberos at work. A two-line summary of Kerberos is the following:

Every machine trusts the Kerberos server. The Kerberos server authenticates users, and give them tickets which they then show to the other machines. Tickets are limited in time and scope.

X.509 is a standard format for digital certificates, which bind identities to public keys. X.509 works when applied to a specific domain through a profile; the profile tries to narrow down the wide possibilities of X.509 into a workable set of options. The profile for "the Internet" is RFC 5280 and its most visible and widespread application is the issuance of certificates for SSL servers. Whenever you connect your browser to an https:// Web site, then X.509 certificates are at work.

SET was another X.509 profile. It was rather thorough in that it was making X.509 much more simple, by removing hordes of useless options; and it also defined a few extensions which were generally needed. However, commercial success and scientific rationality have never been the same thing; SET never became a "de-facto standard" and is all but abandoned nowadays.

For teaching material, be sure to read the X.509 style guide from Peter Gutmann. Students love sarcasm and jokes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.