Re: [kitten] One question about Kerberos Protocol in the RFC 4120

Thanks a lot for your clarification. I'll check the  MIT krb5 KDC
implementations later.Thanks again!😄😄

Derek Atkins <derek@ihtfp.com> 于2021年8月19日周四 上午4:22写道：

> Hi,
>
> On Wed, August 18, 2021 4:01 pm, Greg Hudson wrote:
> > On 8/18/21 11:53 AM, bc a wrote:
> >> So I want to know whether it can be considered that the authentication
> >> server creates two "keys" in the AS-REP phase， one in the "enc-part" of
> >> the "ticket" field,
> >> and the other one is in the separate "enc-part" , And whether these two
> >> "key" values are the same?
> >
> > The two key values are the same.  For an AP exchange to work, the ticket
> > session key must be available to both the client and the application
> > service.  The key field in the EncKDCRepPart is visible to the client,
> > while the key field in the EncTicketPart is visible to the application
> > service.
> >
> > I see that Derek gave the opposite answer.
>
> I didn't *quite* give the opposite answer.  Every session key is unique.
> But you are correct that I was unclear on the fact that the KDC has to
> transmit the same session key to the user and the service.
>
> >   You can check the Heimdal or
> > MIT krb5 KDC implementations to see that the same key value is used in
> > both places.  In MIT krb5, the relevant lines are in
> src/kdc/do_tgs_req.c:
> >
> >     enc_tkt_reply.session = &session_key;
> >     [...]
> >     reply_encpart.session = &session_key;
> >
> > and similarly in do_as_req.c.
>
> -derek
>
> > _______________________________________________
> > Kitten mailing list
> > Kitten@ietf.org
> > https://www.ietf.org/mailman/listinfo/kitten
> >
>
>
> --
>        Derek Atkins                 617-623-3745
>        derek@ihtfp.com             www.ihtfp.com
>        Computer and Internet Security Consultant
>
>