IETF Logo Mail Archive

Re: [Ietf-krb-wg] Interop issues related to TGS subkeys

ghudson@MIT.EDU Thu, 21 May 2009 17:00 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@core3.amsl.com
Delivered-To: ietfarch-krb-wg-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B834828C152 for <ietfarch-krb-wg-archive@core3.amsl.com>; Thu, 21 May 2009 10:00:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XTtCPQqlwC5Z for <ietfarch-krb-wg-archive@core3.amsl.com>; Thu, 21 May 2009 10:00:11 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by core3.amsl.com (Postfix) with ESMTP id 61BA43A6FDF for <krb-wg-archive@lists.ietf.org>; Thu, 21 May 2009 09:59:39 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.ctd.anl.gov (Postfix) with ESMTP id 617BD46; Thu, 21 May 2009 12:00:56 -0500 (CDT)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id 3C7083A; Thu, 21 May 2009 12:00:54 -0500 (CDT)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 0B99D80E07; Thu, 21 May 2009 12:00:54 -0500 (CDT)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by lists.anl.gov (Postfix) with ESMTP id 12FB480E02 for <ietf-krb-wg@lists.anl.gov>; Thu, 21 May 2009 12:00:52 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id EEC8B7CC12F; Thu, 21 May 2009 12:00:51 -0500 (CDT)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10169-01-3; Thu, 21 May 2009 12:00:51 -0500 (CDT)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay2.anl.gov (Postfix) with ESMTP id 0C20D7CC121 for <ietf-krb-wg@lists.anl.gov>; Thu, 21 May 2009 12:00:50 -0500 (CDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AqsAACgmFUoSBwdQkWdsb2JhbACWdXwBAQEBCQsKBxEFqXGHbIhOhAkF
X-IronPort-AV: E=Sophos;i="4.41,228,1241413200"; d="scan'208";a="27250563"
Received: from biscayne-one-station.mit.edu ([18.7.7.80]) by mailgateway.anl.gov with ESMTP; 21 May 2009 12:00:47 -0500
Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by biscayne-one-station.mit.edu (8.13.6/8.9.2) with ESMTP id n4LH0iFm021433 for <ietf-krb-wg@lists.anl.gov>; Thu, 21 May 2009 13:00:44 -0400 (EDT)
Received: from localhost (EQUAL-RITES.MIT.EDU [18.18.1.59]) (authenticated bits=0) (User authenticated as ghudson@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.6/8.12.4) with ESMTP id n4LH0hoE016315 for <ietf-krb-wg@lists.anl.gov>; Thu, 21 May 2009 13:00:43 -0400 (EDT)
Date: Thu, 21 May 2009 13:00:43 -0400
From: ghudson@MIT.EDU
Message-Id: <200905211700.n4LH0hoE016315@outgoing.mit.edu>
To: ietf-krb-wg@lists.anl.gov
In-Reply-To: <200905201847.n4KIlIlV024806@outgoing.mit.edu>
References: <200905201847.n4KIlIlV024806@outgoing.mit.edu>
X-Scanned-By: MIMEDefang 2.42
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Subject: Re: [Ietf-krb-wg] Interop issues related to TGS subkeys
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.11
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: ietf-krb-wg-bounces@lists.anl.gov
Errors-To: ietf-krb-wg-bounces@lists.anl.gov

I realized that I forgot to mention a fourth subkey interop issue.

4. tgs-req subkeys = tgs-rep enc-part key ambiguity

This one is very simple.  RFC 4120 states:

   The ciphertext part of the response in the KRB_TGS_REP message is
   encrypted in the sub-session key from the Authenticator, if present,
   or in the session key from the TGT.

I think the intent is that the subkey must be used if present,
although the language isn't as strong as it probably should be.  MIT
and AD encrypt the enc-part response in the subkey if one is present,
but Heimdal encrypts the enc-part in the TGS session key regardless.

The workaround for clients using subkeys is equally simple: try
decrypting the enc-part with the subkey and key usage 9, and if that
fails, retry with the TGS session key and key usage 8.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email