very slow logon using smart card through wan link

[barabba]

Hello all,

our company has a corporate policy shat foresees the use of a smart
card and CA to process authentication to xp domain computers (Windows
2000 native mode).

All xp boxes use smart card and that's fine.
Now we have a branch abroad that was migrated to a Citrix Terminal
Server solution. The branch (4 people) is connected through a 128kb
line and is 6000 miles away, thus we have a high latency of approx.
300 ms (using 32 bytes packets).

Unfortunately, while the authentication in the LAN network takes about
4-5 seconds, the Citrix branch takes about 1 minute and longer.
Now I understand the problem is the slow link and its high latency,
but because I'm not an expert in Smart Card and CA, I was wondering if
anybody has seen this before and if there are any workarounds to
improve the situation.

Thank you very much in advance.
Bar

 

[David H. Lipman]

I would upgrade to a faster link than 128kb.

That's basically ISDN !

I also suggest reposting this in... microsoft.public.security.crypto

Dave



| Hello all,
|
| our company has a corporate policy shat foresees the use of a smart
| card and CA to process authentication to xp domain computers (Windows
| 2000 native mode).
|
| All xp boxes use smart card and that's fine.
| Now we have a branch abroad that was migrated to a Citrix Terminal
| Server solution. The branch (4 people) is connected through a 128kb
| line and is 6000 miles away, thus we have a high latency of approx.
| 300 ms (using 32 bytes packets).
|
| Unfortunately, while the authentication in the LAN network takes about
| 4-5 seconds, the Citrix branch takes about 1 minute and longer.
| Now I understand the problem is the slow link and its high latency,
| but because I'm not an expert in Smart Card and CA, I was wondering if
| anybody has seen this before and if there are any workarounds to
| improve the situation.
|
| Thank you very much in advance.
| Bar

 

[barabba]

I don't think so. ISDN would have the same latency due to the high distance.
I guess the problem is not the line being slow, but its latency.

Thanks anyway.
Bar

 

[David H. Lipman]

No, I'm saying 128kb/s is comparable to ISDN.

Get something faster.

Dave



| I don't think so. ISDN would have the same latency due to the high distance.
| I guess the problem is not the line being slow, but its latency.
|
| Thanks anyway.
| Bar
|
| > I would upgrade to a faster link than 128kb.
| >
| > That's basically ISDN !
| >
| > I also suggest reposting this in... microsoft.public.security.crypto
| >
| > Dave
| >
| >
| >
| > | > | Hello all,
| > |
| > | our company has a corporate policy shat foresees the use of a smart
| > | card and CA to process authentication to xp domain computers (Windows
| > | 2000 native mode).
| > |
| > | All xp boxes use smart card and that's fine.
| > | Now we have a branch abroad that was migrated to a Citrix Terminal
| > | Server solution. The branch (4 people) is connected through a 128kb
| > | line and is 6000 miles away, thus we have a high latency of approx.
| > | 300 ms (using 32 bytes packets).
| > |
| > | Unfortunately, while the authentication in the LAN network takes about
| > | 4-5 seconds, the Citrix branch takes about 1 minute and longer.
| > | Now I understand the problem is the slow link and its high latency,
| > | but because I'm not an expert in Smart Card and CA, I was wondering if
| > | anybody has seen this before and if there are any workarounds to
| > | improve the situation.
| > |
| > | Thank you very much in advance.
| > | Bar

 

[barabba]

Thank you for your answer.
However, even with a faster line, I would still have latency problems
(as I wrote the SmartCard Reader is 6000 miles away from the DC).
Nevermind.

Is there anything that can be done without upgrading the line ? Maybe
changing cryptographic protocol, etc. etc. ? Sorry I'm not a
specialist of Smart Card Authentication...

Thanks
Bar

 

[David H. Lipman]

How about a Domain Controller at the remote site ?

That's what I have done over a T1 line only a mere 77 miles away.

Dave




| Thank you for your answer.
| However, even with a faster line, I would still have latency problems
| (as I wrote the SmartCard Reader is 6000 miles away from the DC).
| Nevermind.
|
| Is there anything that can be done without upgrading the line ? Maybe
| changing cryptographic protocol, etc. etc. ? Sorry I'm not a
| specialist of Smart Card Authentication...
|
| Thanks
| Bar
|
| > No, I'm saying 128kb/s is comparable to ISDN.
| >
| > Get something faster.
| >
| > Dave
| >
| >
| >
| > | > | I don't think so. ISDN would have the same latency due to the high distance.
| > | I guess the problem is not the line being slow, but its latency.
| > |
| > | Thanks anyway.
| > | Bar
| > |
| > | > | > I would upgrade to a faster link than 128kb.
| > | >
| > | > That's basically ISDN !
| > | >
| > | > I also suggest reposting this in... microsoft.public.security.crypto
| > | >
| > | > Dave
| > | >
| > | >
| > | >
| > | > | > | > | Hello all,
| > | > |
| > | > | our company has a corporate policy shat foresees the use of a smart
| > | > | card and CA to process authentication to xp domain computers (Windows
| > | > | 2000 native mode).
| > | > |
| > | > | All xp boxes use smart card and that's fine.
| > | > | Now we have a branch abroad that was migrated to a Citrix Terminal
| > | > | Server solution. The branch (4 people) is connected through a 128kb
| > | > | line and is 6000 miles away, thus we have a high latency of approx.
| > | > | 300 ms (using 32 bytes packets).
| > | > |
| > | > | Unfortunately, while the authentication in the LAN network takes about
| > | > | 4-5 seconds, the Citrix branch takes about 1 minute and longer.
| > | > | Now I understand the problem is the slow link and its high latency,
| > | > | but because I'm not an expert in Smart Card and CA, I was wondering if
| > | > | anybody has seen this before and if there are any workarounds to
| > | > | improve the situation.
| > | > |
| > | > | Thank you very much in advance.
| > | > | Bar

 

[barabba]

No. As I wrote, It's a terminal server... Adding a Domain Controller
would double up the time necessary to authenticate.

My original question was: is there anything that can be done by
tweaking the CA (crypto protocol, etc.) ?

Thanks...
Bar