[17008] in Kerberos-V5-bugs
[krbdev.mit.edu #9166] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Thu Mar 13 19:17:54 2025
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-2057213-1741907868-1446.9166-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9166":;
Date: Thu, 13 Mar 2025 19:17:48 -0400
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Thu Mar 13 19:17:48 2025: Request 9166 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9166 >
Add PKINIT paChecksum2 from MS-PKCA v20230920
In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2
element in the PKAuthenticator sequence. This checksum accepts SHA-1,
SHA-256, SHA-384, and SHA-512 digests.
In Windows Server 2025, this checksum becomes mandatory when using
PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as
allowed).
[ghudson@mit.edu: refactored crypto interfaces to reduce complexity of
calling code]
https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
Author: Julien Rische <jrische@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 310793ba63782af5ffa3a95d20e41f8f03ca7e00
Branch: master
src/include/k5-int-pkinit.h | 25 +++--
src/lib/krb5/asn.1/asn1_k_encode.c | 18 +++-
src/plugins/preauth/pkinit/pkinit.h | 1 +
src/plugins/preauth/pkinit/pkinit_clnt.c | 41 +++-----
src/plugins/preauth/pkinit/pkinit_constants.c | 42 ++++++--
src/plugins/preauth/pkinit/pkinit_crypto.h | 24 ++++-
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 116 ++++++++++++++++++++-
src/plugins/preauth/pkinit/pkinit_kdf_test.c | 6 +-
src/plugins/preauth/pkinit/pkinit_lib.c | 16 ++-
src/plugins/preauth/pkinit/pkinit_srv.c | 38 ++-----
src/plugins/preauth/pkinit/pkinit_trace.h | 5 +-
src/tests/asn.1/krb5_decode_test.c | 2 +-
src/tests/asn.1/ktest.c | 7 +-
src/tests/asn.1/ktest_equal.c | 2 +-
src/tests/asn.1/pkinit_encode.out | 2 +-
src/tests/asn.1/pkinit_trval.out | 2 +-
16 files changed, 251 insertions(+), 96 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
