[17548] in Kerberos_V5_Development
Re: clock skew and preauth
daemon@ATHENA.MIT.EDU (Nico Williams)
Thu Apr 5 14:44:46 2012
MIME-Version: 1.0
In-Reply-To: <4F7DDBB6.1050908@gnome.org>
Date: Thu, 5 Apr 2012 13:44:37 -0500
Message-ID: <CAK3OfOgMfMZ92GvC6zSKAT+6nz2fnTb4KvYA9T0Q0V5PMUwC3Q@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Stef Walter <stefw@gnome.org>
Cc: krbdev@mit.edu, tlyu@mit.edu
Content-Type: text/plain; charset="utf-8"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Thu, Apr 5, 2012 at 12:51 PM, Stef Walter <stefw@gnome.org> wrote:
> On 2012-04-05 19:48, Nico Williams wrote:
>> If we're going to go this far, why not associate a realm name with
>> each offset? That way a multi-client-principal application can cope
>> with each client realm having the wrong time.
>
> Yes, I was going to look at that next ;)
>
> But this preauth stuff is (and should be) conceptually separate. The
> preauth server timestamp is untrusted, and so we shouldn't store it
> anywhere. It's just to be used in the next encrypted timestamp preauth
> reply. Essentially it becomes a challenge that we receive from the
> server, which we respond to by encrypting it and sending it back.
Ah, fair enough. But what about the per-ccache time offset? It
normally gets stored in the krb5_context.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
