http://www.networkworld.com/news/2000/0511kerberos.html



Microsoft's Kerberos shuck and jive

 	

By Dominic Gates
The Industry Standard, 05/11/00 

Slammed in a court brief for the proprietary way it implements the Kerberos Web security standard in Windows 2000, Microsoft (MSFT) has moved to reassure customers and disarm critics by publishing the formerly secret details of its version of Kerberos - just one day before the brief was filed. 

Better late than never? Perhaps, but Microsoft has attached licensing restrictions to the site where the details are published, essentially locking down the information as a confidential "trade secret." 
Advertisement:
 

In other words, the information can be reviewed, but no competitor can exploit the published details in order to write code that could make use of it. 

"They don't want anyone competing against them," says Paul Hill, co-leader of the Kerberos team at MIT, where the security standard was developed. "It's typical Microsoft behavior." 

Microsoft critics have long deplored the company's cavalier attitude toward standards, famously summed up as "embrace, extend and extinguish," a phrase attributed to the current head of the software giant's Windows group, Paul Maritz, during the ongoing Microsoft antitrust trial. The implication is that Microsoft embraces standards that ensure basic interoperability on the Internet but adds proprietary extensions to those standards that make rival systems less interoperable - with the intent of extinguishing competition. 

Microsoft's implementation of Kerberos seems a textbook example of this alleged modus operandi. Web specifications typically contain parts that are left undefined, onto which vendors may add their own extensions, allowing for variation in implementation. The version of Kerberos in every Windows 2000 PC formally complies with the standard specification. It also takes advantage of an undefined field in the spec to store authorization data for Microsoft's operating system. 

In a paper filed in the antitrust trial on April 28, expert witness Rebecca Henderson, an MIT professor who supported the government's proposed remedy of splitting Microsoft in two, concluded that because Microsoft hadn't published those extensions, "no non-Microsoft server can utilize the security features of the PC operating system." 

Microsoft begs to differ, pointing out that it published the extensions on April 27 - timing which it claims is a pure coincidence. The Redmond, Wash., software monolith also argues that its version of Kerberos is fully interoperable. 

As proof of its interoperability, Shanen Boettcher, lead product manager for Windows 2000 Server, cites customers such as Morgan Stanley Dean Witter that installed Windows 2000 desktops in a network running an existing Kerberos implementation by a company called CyberSafe in Issaquah, Wash. According to Microsoft, the successful installation of its Kerberos implementation alongside CyberSafe's "validates the interoperability of Kerberos in the Windows 2000 operating system." 

But this validity depends on the definition of "interoperable." In Microsoft's view, Kerberos interoperability covers only the authentication process (the password system that validates a user's identity), which is defined in the open part of the spec. That interoperability does not, however, extend to the authorization process (the system that decides if a particular user has access to resources on the network), which is the part Microsoft addressed in that carefully guarded undefined field. 

Microsoft is treating the authorization process as totally proprietary because authorization to use a Microsoft application requires a Windows 2000 Server. "If you want access rights to applications on Windows, it has to process its own authorization," says Boettcher. 

Customers, like Morgan Stanley, that want to access basic functions such as file and print services from Windows 2000 desktops must purchase and run a Microsoft Windows 2000 Kerberos Server, even if they already have another Kerberos implementation in use. 

For Hill, that amounts to Microsoft gratuitously tying the desktop to the server. 

"Microsoft has created a system that forces Morgan Stanley and many other government and academic institutions to run Microsoft servers," he says. "These organizations now have to duplicate essentially the same data into two separate systems." 

As Hill sees it, this way of implementing Kerberos shatters the notion of an interoperable "standard." And the licensing restrictions Microsoft has imposed on publishing the data-field information mean that it still isn't a standard at all. 

"It's a clear demonstration that Microsoft has no intention of changing its business practices," says Hill. "It's using its monopoly on the desktop to force people to use its server." 

For more in-depth coverage of the Internet Economy, visit The Industry Standard, a sister publication to Network World. Copyright 2000 The Industry Standard. All rights reserved.


http://www.thestandard.com/