[22235] in Kerberos
Re: GSSAPI security for connection encryption
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Wed Aug 18 15:43:51 2004
In-Reply-To: <200408181052.i7IAqeV2002948@fort-point-station.mit.edu>
Mime-Version: 1.0 (Apple Message framework v619)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <C466F67B-F14E-11D8-A697-000A95909EE2@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Wed, 18 Aug 2004 15:42:41 -0400
To: Markus Moeller <huaraz@moeller.plus.com>
cc: "'kerberos@mit.edu'" <kerberos@mit.edu>
Errors-To: kerberos-bounces@mit.edu
On Aug 18, 2004, at 06:52, Markus Moeller wrote:
> If I want to secure a connection between a client and a server with
> gssapi. I
> have to cut the data into blocks to fit into the buffers used by
> gss_wrap and
> gss_unwrap. Is there any check that these blocks are send in the right
> order and
> not tampered with. As far as I understand it each block is protected,
> but not the
> sequence of the blocks.
>
> Does this mean gssapi encryption on connections is flawed ?
No, GSSAPI mechanisms can provide sequencing checks, although they
aren't required to. (Kerberos can provide it.) Look at the req_flags
and ret_flags arguments to gss_init_sec_context.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
