[kitten] RFC8636 paChecksum Agility

[Andrew Wiley <[e-mail]>]

Hello Kitten,

We’ve started work on PKINIT agility in RFC 8636 in the Windows stack and we’ve found one issue we’d like to raise.
Section 3 describes how the SHA-1 checksum in paChecksum binds the preauthentication data to the request body and that in DH key agreement, the KDF supplements it. However, the KDF does not bind the preauthentication data to the request body – it only binds the response to the full request including preauthentication data.

This is not a security issue per se, but it seems to be problematic. With all of RFC8636 in place, a malicious client could observe a PKINIT AS-REQ on the wire, put the preauthentication data into a separate AS-REQ, and replay it (against a different KDC in the same realm). This should not result in a response the malicious client can decrypt and use, but it allows the client to manipulate audit logs and lockout counters without real credentials. The malicious client can also manipulate the supported etypes in the AS-REQ to potentially force a downgrade that could allow the ticket to be used if an attack against the etype of the reply key is available.

These are definitely defense-in-depth measures and only expose serious threats against realms with weak etypes enabled, but we know historically that cryptographic changes are very slow and we believe these are worth mitigating. We’re considering extending the PKAuthenticator structure, probably with an octet string for a digest and an AlgorithmIdentifier to identify the algorithm used to generate it. There would be a matching KDC error to allow the KDC to reject weak digest algorithms.

Any thoughts?

Thanks,
Andrew