Re: [kitten] RFC8636 paChecksum Agility

[Greg Hudson <[e-mail]>]

On 2/4/21 6:28 PM, Andrew Wiley wrote:
> Section 3 describes how the SHA-1 checksum in paChecksum binds the preauthentication data to the request body and that in DH key agreement, the KDF supplements it. However, the KDF does not bind the preauthentication data to the request body – it only binds the response to the full request including preauthentication data.

This is stated in the security considerations:

   The paChecksum field, which binds the client pre-authentication data
   to the Kerberos request body, remains fixed at SHA-1.  If an attacker
   substitutes a different request body using an attack against SHA-1 (a
   second preimage attack is likely required as the attacker does not
   control any part of the legitimate request body), the KDC will not
   detect the substitution.  Instead, if a new KDF is negotiated, the
   client will detect the substitution by failing to decrypt the reply.

This choice of binding the reply key rather than the request padata
appears to date all the way back to the first draft in 2006 by Love and
Larry.  I can't find a working group archive going back that far, so I
don't know what their reasoning was.