<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div> </div>
<div>Hi Mike,</div>
<div> </div>
<div>
<div>I have a big catalog of constraints, but three of them are really challenging:</div>
<div>- no secret (pre shared key or private key) is allowed to be saved on the client computer</div>
<div>- no additional third-party software is allowed to be installed on the client computer</div>
- no "complicated" configuration changings on the client computers</div>
<div> </div>
<div>> Is it possible to configure client browsers to use a proxy to connect<br/>
> the sensitive servers? Maybe you could use proxy authentication<br/>
> instead of TLS authentication or web application.</div>
<div> </div>
As far as I know for proxy authentication I have to use a pre shared key which have to be saved together with the URI in the connection settings of the browser. So the secret is saved on the client computer - a disqualifier. Additional I have a gut feeling that they will not like to change the proxy settings in the browsers.
<div> </div>
<div>> What about using a VPN for the sensitive servers?</div>
<div> </div>
<div>I also thought about this already. At the moment all clients are Windows 7 and Windows 8.1 . So a L2TP-IPsec-IKEv2-VPN with TOTP-Password is in my presentation-slides as a possible solution (no additional software on the client computer necessary and no secret is saved on the client computer). But also in this case I have a gut feeling that they will not like it...</div>
<div> </div>
<div>> Unfortunately SSL/TLS was never designed for interactive authentication.</div>
<div> </div>
<div>I did not know this until now. So I read just now a bit more about it. You are right. It is really a pity. It is even real bad luck that there is a TLS-SRP Extension (https://en.wikipedia.org/wiki/TLS-SRP) which is even supported by OpenSSL, but no web browser is supporting it. </div>
<div> </div>
<div>> Why exactly you cannot use client certificates?<br/>
> Maybe there is something I can do about it.</div>
<div> </div>
<div>In fact it is not really impossible to use client certificates. It is just forbidden to save the private key on the client computer (also the Windows Certificate Store is out of game). But until now I never used PKI-USB-Sticks or a Smart-Card-Reader together with a PKI-Smartcard. Maybe there are such PKI-USB-Sticks available which fits to the constraints (i.e. no additional third-party software - also no additional drivers for MS Windows) which can be accessed by IE and Firefox through PKCS#11 or Microsoft CryptoAPI. Maybe you have suggestions for this?</div>
<div> </div>
<div>Best regards,</div>
<div>Martin</div>
</div>
<div> </div></div></body></html>