Re: [kitten] [EXTERNAL] Re: Question about AES mode in Kerberos

I propose adding something like:

When the acceptor proposes a sub-session key, the initiator MUST send
a sub-session key in the AP-REQ which SHALL be used to encrypt the
AP-REP enc-part rather than the ticket session key.  This avoids an
attacker replaying an AP-REP and forcing the initiator to reuse an
acceptor sub-session key.  Key reuse breaks the security properties
of encryption types such as GCM.

> On 6 Jan 2023, at 7:30 pm, Luke Howard <lukeh=40padl.com@dmarc.ietf.org> wrote:
> 
> Slightly refreshed draft here:
> 
> https://www.ietf.org/archive/id/draft-howard-gssapi-aead-01.txt
> 
> Refreshed implementation here:
> 
> https://github.com/heimdal/heimdal/tree/lukeh/aes-gcm
> 
> I added some text about why EC and RRC are safe to leave unprotected (they’re known constants which can be validated by the peer, generally zero except for EC wrap tokens without confidentiality).
> 
> Nico points out we should use this opportunity to encrypt the AP-REP enc-part in the initiator sub-session rather than the ticket session key. Otherwise you can replay an AP-REP against an AP-REQ made with the same ticket, which would be bad for GCM (as we are using a deterministic IV). I haven’t updated the draft yet to reflect this.
> 
>> On 5 Jan 2023, at 3:32 pm, Luke Howard Bentata <lukeh=40padl.com@dmarc.ietf.org <mailto:lukeh=40padl.com@dmarc.ietf.org>> wrote:
>> 
>> 
>> 
>>> On 5 Jan 2023, at 12:39 pm, Steve Syfuhs (AP) <Steve.Syfuhs=40microsoft.com@dmarc.ietf.org <mailto:Steve.Syfuhs=40microsoft.com@dmarc.ietf.org>> wrote:
>>> 
>>> Us Windows folks are vaguely interested. With our RC4 deprecation work winding down, it’d be nice to get something going for post-sha256. That said we don’t have a need for GCM yet. Just looking at it from a crypto-agility perspective.
>> 
>> Because the profile doesn’t actually support longterm keys, it avoids any longterm key-related agility issues (you’d carry on using AES session keys, and CCM/GCM is negotiated through RFC4537). So that makes things a little more straightforward.
>> 
>> Anyway, have a look at the drafts, let me know if you have any questions, in the interim I’m rebasing on top of Heimdal master.
>> _______________________________________________
>> Kitten mailing list
>> Kitten@ietf.org <mailto:Kitten@ietf.org>
>> https://www.ietf.org/mailman/listinfo/kitten
> 
> _______________________________________________
> Kitten mailing list
> Kitten@ietf.org
> https://www.ietf.org/mailman/listinfo/kitten