[3947] in Kerberos-V5-bugs
daemon@ATHENA.MIT.EDU (Sam Hartman via RT)
Fri Feb 21 14:37:57 2003
Date: Fri, 21 Feb 2003 14:37:31 -0500 (EST)
Mail-Followup-To: rt@krbdev.mit.edu
Message-Id: <rt-1352-4608.15.2778166251206@krbdev.mit.edu>
In-Reply-To: <rt-1352@krbdev.mit.edu>
From: "Sam Hartman via RT" <rt-comment@krbdev.mit.edu>
Mail-Copies-To: never
To: wyllys.ingersoll@sun.com
cc: krb5-prs@mit.edu
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
>>>>> "Wyllys" == Wyllys Ingersoll via RT <rt-comment@krbdev.mit.edu> writes:
Wyllys> When using mutual authentication, at the time the initial
Wyllys> token is generated, the status is still "CONTINUE_NEEDED"
Wyllys> and the context->established flag is not set even though
Wyllys> the PROT_READY flag is set and the subkey is available.
Wyllys> We think (Nico and I) that gss_get_mic should be able to
Wyllys> succeed in this case. I had not considered the "unseal"
Wyllys> case since that was not a problem. The acceptor side
Wyllys> context is already "established" when the MIC is verified,
Wyllys> so it wasnt a problem.
But you should not be generating the MIC at this point.
negTokenInit
Negotiation token sent by the initiator to the target, which
contains, for the first token sent, one or more security mechanisms
supported by the initiator (as indicated in the field mechTypes)
and the service options (reqFlags) that are requested to establish
the context. The context flags should be filled in from the
req_flags parameter of init_sec_context().
The mechToken field is optional for the first token sent that all
target implementations would not have to support. However for those
targets that do support piggybacking the initial mechToken, an
optimistic negotiation response is possible. Otherwise the
mechToken is used to carry the tokens specific to the mechanism
selected.
Baize & Pinkas Standards Track [Page 7]
RFC 2478 GSS-API Negotiation Mechanism December 1998
The mechListMIC is an optional field. In the case that the chosen
mechanism supports integrity, the initiator may optionally include
a mechListMIC which is the result of a GetMIC of the MechTypes in
the initial NegTokenInit and return GSS_S_COMPLETE.
That text from 2478 indicates you can only include the mechlistmic in
the initial token when the mechanism returns GSS_S_COMPLETE.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
