Re: [kitten] One question about Kerberos Protocol in the RFC 4120

[Greg Hudson <[e-mail]>]

On 8/18/21 11:53 AM, bc a wrote:
> So I want to know whether it can be considered that the authentication
> server creates two "keys" in the AS-REP phase， one in the "enc-part" of
> the "ticket" field,
> and the other one is in the separate "enc-part" , And whether these two
> "key" values are the same?

The two key values are the same.  For an AP exchange to work, the ticket
session key must be available to both the client and the application
service.  The key field in the EncKDCRepPart is visible to the client,
while the key field in the EncTicketPart is visible to the application
service.

I see that Derek gave the opposite answer.  You can check the Heimdal or
MIT krb5 KDC implementations to see that the same key value is used in
both places.  In MIT krb5, the relevant lines are in src/kdc/do_tgs_req.c:

    enc_tkt_reply.session = &session_key;
    [...]
    reply_encpart.session = &session_key;

and similarly in do_as_req.c.