Re: [Ietf-krb-wg] Interop issues related to TGS subkeys

[[e-mail]]

As promised, I'm back to report on a third subkey interop issue:

3. tgs-req subkeys + enc-authorization-data = key ambiguity

RFC 4120 specifies:

      The enc-authorization-data, if present (and it can only be present
      in the TGS_REQ form), is an encoding of the desired
      authorization-data encrypted under the sub-session key if present
      in the Authenticator, or alternatively from the session key in the
      TGT (both the Authenticator and TGT come from the padata field in
      the KRB_TGS_REQ).  The key usage value used when encrypting is 5
      if a sub-session key is used, or 4 if the session key is used.

We have verified that Heimdal, AD 2003, and AD 2008, and MIT krb5 1.7
get this right.  Unfortunately, MIT krb5 prior to 1.7 does not; it
attempts to decrypt the enc-authorization-data with the TGS session
key and usage 4 regardless of whether a subkey is present.

I am not aware of any current use cases for enc-authorization-data in
TGS requests.  (We were previously expecting to use it for TGS FAST,
but it turns out we will be using the authenticator's authorization
data field instead.)  However, any implementor who comes up with a
reason to use it may want to be aware of the interoperability problem
with MIT krb5 <1.7 KDCs.  I'm not aware of any good workarounds
besides the obvious ones: (1) don't do it, and (2) try it the right
way, then retry it the wrong way if you get an integrity error reply.
_______________________________________________
ietf-krb-wg mailing list
[e-mail]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg