[16895] in Kerberos-V5-bugs
[krbdev.mit.edu #9095] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Jul 17 01:46:48 2023
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-2879536-1689572799-113.9095-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9095":;
Date: Mon, 17 Jul 2023 01:46:39 -0400
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Jul 17 01:46:39 2023: Request 9095 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9095 >
PKINIT ECDH support
Add support for elliptic curve key exchange to PKINIT (RFC 5349
section 4). Extend pkinit_dh_min_bits to allow the string values
"P-256", "P-384", and "P-521", using rough finite-field strength
equivalents to rank them relative to the Oakley Diffie-Hellman groups.
When processing TD-DH-PARAMETERS on the client, only accept the three
Oakley groups or the three supported elliptic curve groups.
Previously we accepted any Diffie-Hellman parameters that passed
EVP_PKEY_param_check()/DH_check() and had equal or better bit strength
to the original proposal.
https://github.com/krb5/krb5/commit/0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Author: Greg Hudson <ghudson@mit.edu>
Commit: 0f870b1bcad960fd5319a3f97aafd7f4a289e2fb
Branch: master
doc/admin/conf_files/kdc_conf.rst | 7 +-
doc/admin/conf_files/krb5_conf.rst | 7 +-
src/plugins/preauth/pkinit/pkinit.h | 6 +-
src/plugins/preauth/pkinit/pkinit_clnt.c | 17 +-
src/plugins/preauth/pkinit/pkinit_constants.c | 27 ++
src/plugins/preauth/pkinit/pkinit_crypto.h | 7 +
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 470 ++++++++++++++-------
src/plugins/preauth/pkinit/pkinit_crypto_openssl.h | 4 +-
src/plugins/preauth/pkinit/pkinit_lib.c | 3 -
src/plugins/preauth/pkinit/pkinit_srv.c | 17 +-
src/plugins/preauth/pkinit/pkinit_trace.h | 11 +
src/tests/t_pkinit.py | 12 +
12 files changed, 405 insertions(+), 183 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
