[16943] in Kerberos-V5-bugs
[krbdev.mit.edu #9123] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Thu Jun 20 17:16:06 2024
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3363826-1718918160-937.9123-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9123":;
Date: Thu, 20 Jun 2024 17:16:00 -0400
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Thu Jun 20 17:16:00 2024: Request 9123 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9123 >
Correct IAKERB protocol implementation
The initial implementation of IAKERB in MIT krb5 mistakenly used
draft-zhu-ws-kerb instead of draft-kitten-ietf-iakerb, and
additionally used the wrong ASN.1 tag value for the target-realm field
of the IAKERB-HEADER sequence. Correct the following aspects of the
protocol implementation:
* Require and use framing on all messages, not just the initial
context token.
* Use extension value 2 for the finish message instead of 1.
* Use key usage value 41 instead of 42 for the finish message
checksum.
* Use UTF8String (12) for target-realm instead of OCTET STRING (4).
With these changes, the IAKERB implementation is interoperable with
other krb5 implementations, but not with the implementation before
these changes.
https://github.com/krb5/krb5/commit/04f9c19c98aed91d96afa377557da86e04db6b44
Author: Greg Hudson <ghudson@mit.edu>
Commit: 04f9c19c98aed91d96afa377557da86e04db6b44
Branch: master
doc/appdev/refs/macros/index.rst | 1 +
src/include/krb5/krb5.hin | 1 +
src/lib/gssapi/krb5/accept_sec_context.c | 2 +-
src/lib/gssapi/krb5/gssapiP_krb5.h | 2 +-
src/lib/gssapi/krb5/iakerb.c | 45 +++++++++-----------------------
src/lib/gssapi/krb5/init_sec_context.c | 2 +-
src/lib/krb5/asn.1/asn1_k_encode.c | 2 +-
src/tests/asn.1/krb5_decode_test.c | 2 +-
src/tests/asn.1/reference_encode.out | 2 +-
src/tests/asn.1/trval.c | 4 ++-
src/tests/asn.1/trval_reference.out | 7 ++---
11 files changed, 26 insertions(+), 44 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
