Authentication information is the data the user has to provide to be granted access to various resources.

Examples are passwords and keys.

This data has to be stored somewhere. Passwords are remembered (and forgotten). keys are saved on disk.

Few problems arise here

1. it is difficult to remember many passwords, so users tends to choose easy ones and predictable thus possible to be guessed.
2. keys are stored on media in cleartext or simple encoding, from where they can be recovered when machine is offline.
3. during work, every application beeing run by user has access to keys and all system processes. it can be helped a bit by by MAC systems by restricting each application to its own keys, but that’s not enough. to defend against offline attacks keys are frequently stored enrypted. this leads to another problem:
4. user has even more passwords to remember. decrypted versions are beeing kept in userspace memory and not protected.
5. some applications do not care about sensitive data processing, like, they store such a data in memory which can be swapped out thus storing it on disk in a pernament way making recover possible.

1. passwords and keys are stored enrypted in rsbac data structures
2. user has to provide password to unlock it
3. her account password is used - no need to remember more
4. nothing has direct access to this data
5. applications call special function to operate on sensitive data
6. possibility to define access rights to each stored authentication token

• how are application going to use it ? gpg could be modified, ssh also
• their developers will shoot us
• we don’t care

comments, questions, flames (yes for you murf ! ;) ?

Cons:

1. Single point of failure (one password to rule them all)

Pros:

1. Single sign on.