[16294] in Kerberos_V5_Development
Re: wrong checksum type for arcfour-hmac-md5
daemon@ATHENA.MIT.EDU (Luke Howard)
Wed Sep 15 12:17:12 2010
Message-Id: <8CB4F3DE-38DE-4737-994F-B4A3D8DC06B8@mit.edu>
From: Luke Howard <lhoward@mit.edu>
To: Greg Hudson <ghudson@mit.edu>
In-Reply-To: <1284567173.5992.1662.camel@ray>
Mime-Version: 1.0 (iPhone Mail 7D11)
Date: Wed, 15 Sep 2010 18:15:55 +0200
Cc: "krbdev@mit.edu Dev List" <krbdev@mit.edu>,
Nicolas Williams <nicolas.williams@oracle.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
The trace simo attached showed unkeyed checksum in a tgs req, IIRC
Sent from my iPhone
On 15/09/2010, at 18:12, Greg Hudson <ghudson@MIT.EDU> wrote:
>> Why isn't this considered a bug in the server??
>
> All we know so far (assuming all of the given information is
> correct) is
> that the server will accept a GSSAPI authenticator with an rsa-md5
> checksum--which is not valid--but won't accept one with an hmac-md5
> checksum.
>
> That's not a bug in the server; if anything, the server is being
> overly
> permissive by accepting rsa-md5. It's a bug in the "home-grown
> GSSAPI"
> client that it's not jusing a GSSAPI authenticator checksum.
>
> If there are other circumstances where the server will accept rsa-
> md5 in
> an authenticator and not hmac-md5, that's worth knowing about.
>
>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
