[3940] in Kerberos-V5-bugs
[krbdev.mit.edu #1354] des3 string-to-key
daemon@ATHENA.MIT.EDU (Ken Raeburn via RT)
Mon Feb 17 22:13:00 2003
Date: Mon, 17 Feb 2003 22:11:36 -0500 (EST)
Message-Id: <rt-1354-4601.5.90103989913544@krbdev.mit.edu>
In-Reply-To: <rt-1354@krbdev.mit.edu>
From: "Ken Raeburn via RT" <rt-comment@krbdev.mit.edu>
To: krb5-prs@mit.edu
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
Our current string-to-key for des3 makes no checks or corrections for
weak keys. However, the key schedule generation code will return an
error (after generating key schedules, but the error code *is*
checked) if any of the three keys is weak. One of the two needs to be
changed.
The current crypto draft says we don't do weak-key checks, but that's
because I looked at our string-to-key and not the key scheduling code.
Heimdal does do weak key checking and correction.
I'm going to suggest on the WG list that doing the check is the
correct fix.
Ken
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
