[4149] in Kerberos-V5-bugs
[krbdev.mit.edu #1429] AES/GSS combination broken
daemon@ATHENA.MIT.EDU (Ken Raeburn via RT)
Thu Apr 24 19:24:19 2003
Date: Thu, 24 Apr 2003 19:24:10 -0400 (EDT)
Message-Id: <rt-1429-5832.14.9573615630555@krbdev.mit.edu>
In-Reply-To: <rt-1429@krbdev.mit.edu>
From: "Ken Raeburn via RT" <rt-comment@krbdev.mit.edu>
To: krb5-prs@MIT.EDU
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
Proposed fix from discussion:
Track config-file (or compiled-in) default_tgs_enctypes and
application-supplied list separately in krb5_context. When getting an
intermediate TGT, from the ccache or from a KDC, use the config-file
version only; when getting the ultimate application ticket (even if it's
a TGT for a user running a kvno-like program), prefer the
application-supplied list if any. Distinguish the two with some context
flag, or an added argument to some internal API (unspecified).
Then we should be able to acquire and use AES TGT session keys to get
GSS-supported tickets.
We may have problems with this when we start relying on KDC referrals.
Burn that bridge when we get to it.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
