Pin Registration: Atlas Manufacturing - Netscape MANAGEMENT SYSTEM 4.5 Installation And Setup Manual

Some Enrollment Scenarios
Custom authentication against an existing Kerberos security system
Figure 2-4

PIN Registration: Atlas Manufacturing

Atlas Manufacturing has decided to put information for its employees, suppliers,
dealers, and customers—a total of nearly 500,000 people, including individual
consumers and employees of several dozen other companies—on an extranet.
Atlas already uses Netscape Directory Server to store names, addresses, and other
information about the various groups of people who will need access to the
extranet. To register all these people at once, Atlas uses the directory-based PIN
Generator tool that comes with Certificate Management System to generate PINs in
bulk. The PINs are then stored in the directory and delivered to the end users via a
batch mailer program, an employee payroll stub, a customer invoice, or some other
means of physical delivery.
PINs are salted and hashed before storage in the directory. Salting refers to the
inclusion of additional information from the distinguished name (DN) with the
PIN to ensure unique hashing. Hashing, in this case, involves generating a number
of fixed length from the PIN and DN information. Even if the security of the
directory is breached, it is very difficult to reconstruct the PIN from the value that
Chapter 2 Certificate Enrollment and Life-Cycle Management 91