[22244] in Kerberos
Re: GSSAPI security for connection encryption
daemon@ATHENA.MIT.EDU (Markus Moeller)
Thu Aug 19 16:58:02 2004
Date: Thu, 19 Aug 2004 13:25:28 -0400 (EDT)
Message-Id: <200408191725.i7JHPS4w029742@fort-point-station.mit.edu>
Content-Disposition: inline
Content-Transfer-Encoding: binary
Mime-Version: 1.0
From: Markus Moeller <huaraz@moeller.plus.com>
To: "''kerberos@mit.edu''" <kerberos@mit.edu>, Ken Raeburn <raeburn@mit.edu>
Content-Type: text/plain
Errors-To: kerberos-bounces@mit.edu
will Sequence protection (GSS_C_SEQUENCE_FLAG)cover replay protection
(GSS_C_REPLAY_FLAG) as well or are there cases were I need both ?
Thanks
Markus
On Wed, 18 Aug 2004 15:42 , Ken Raeburn <raeburn@MIT.EDU> sent:
>On Aug 18, 2004, at 06:52, Markus Moeller wrote:
>> If I want to secure a connection between a client and a server with
>> gssapi. I
>> have to cut the data into blocks to fit into the buffers used by
>> gss_wrap and
>> gss_unwrap. Is there any check that these blocks are send in the right
>> order and
>> not tampered with. As far as I understand it each block is protected,
>> but not the
>> sequence of the blocks.
>>
>> Does this mean gssapi encryption on connections is flawed ?
>
>No, GSSAPI mechanisms can provide sequencing checks, although they
>aren't required to. (Kerberos can provide it.) Look at the req_flags
>and ret_flags arguments to gss_init_sec_context.
>
>Ken
>
--
Markus Moeller <huaraz@moeller.plus.com>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
