Re: [kitten] One question about Kerberos Protocol in the RFC 4120

HI,

No session keys are ever the same.
Whenever the KDC creates a session key, it is supposed to be randomly unique.

The only time keys are "the same" is long-lived authentication keys, the
keys shared between the KDC and a user, or between the KDC and a service. 
Those long-term keys are used to encrypt the unique session keys.

Hope this helps.

-derek

On Wed, August 18, 2021 11:53 am, bc a wrote:
>  Dear Kitten members,
>
> I'm Xiaoxing Xu and I'm a cyber security researcher from China. I had a
> question about Kerberos v5 when I read the RFC 4120 paper, which expects
> you to get your reply.
> The question is, I see the "key" appears in the "enc-part" field in the
> "tickets" chapter of section 5.3, just like the first picture shows, and
> the "key" is used to pass the session key.
> So we can think the authentication server creates a session key and put it
> in the "enc-part" of the "tickets" field in the AS-REQ phrase.
> [image: image.png]
> Then in the  section 5.4.2, I found that there is also a "key" exists in
> the "enc-part" of "KDC-REP",  that is to say, there is also a "key" in the
> "enc-part" of the AS-REP phase,
> not the "enc-part" of the "ticket".
> So I want to know whether it can be considered that the authentication
> server creates two "keys" in the AS-REP phase， one in the "enc-part" of
> the
> "ticket" field,
> and the other one is in the separate "enc-part" , And whether these two
> "key" values are the same?
> Thank you so much for your help.
> [image: image.png]
> Best regards
> Xiaoxing Xu
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten
>

-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant