[2250] in Kerberos
Re: Kerberos V5 ASN.1 observation
daemon@ATHENA.MIT.EDU (John T Kohl)
Fri Oct 2 12:24:29 1992
Date: Fri, 2 Oct 92 08:55:36 -0700
From: John T Kohl <jtkohl@cs.berkeley.edu>
To: John Linn <linn@albeit.enet.dec.com>
Cc: kerberos@Athena.MIT.EDU, kaufman@kibitz.enet.dec.com
In-Reply-To: [2246]
> [2246] daemon@ATHENA.MIT.EDU (John Linn. LKG1-2/A19. {(508)-486 ) Kerberos 10/02/92 06:39 (39 lines)
> Date: Fri, 2 Oct 92 09:08:00 EDT
> From: John Linn. LKG1-2/A19. {(508)-486 or DTN 226}-7384. 02-Oct-1992 0910 <linn@albeit.enet.dec.com>
> Apparently-To: kerberos@athena.mit.edu
> In looking at the Kerberos V5 ASN.1 and the tagging employed therein, I
> observed a property which I found desirable, though I'm not sure whether
> it was explicitly intentional or arose by fortutious coincidence. Since
> Kerberos V5 tokens all carry [APPLICATION xx] tags, where xx is
> non-zero, ...
The APPLICATION xx tags are primarily there to provide disambiguation of
things you receive, particularly for encrypted items which an attacker
might attempt to replace; the tag prevents an attacker from substituting
an encrypted structure of one variety for another. Steve Bellovin &
Michael Merritt (as mentioned in their recent post) consider this
potential in more detail.
John Kohl
