[18853] in Kerberos_V5_Development
Re: TGS-REP TICKET decrypting problem
daemon@ATHENA.MIT.EDU (Wang Weijun)
Fri Jun 13 02:15:41 2014
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Wang Weijun <weijun.wang@oracle.com>
In-Reply-To: <CAKSryKVUKgmV7suwo-j030f_9qEvCzA2WPVxCms4+ib_bKL5FQ@mail.gmail.com>
Date: Fri, 13 Jun 2014 14:15:38 +0800
Message-Id: <B0124369-3F14-4946-A89C-81D8C14007D1@oracle.com>
To: somenath saha <saha.somenath.88@gmail.com>
Cc: Danilo Almeida <dalmeida@mit.edu>, "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Yes, Client-2 is the service (it's a computer account, right?) here, and it has the key and is able to decrypt it. A computer can get the key directly from the system through some internal channel. If you want to decrypt on behalf of the computer, you use that keytab.
--Max
On Jun 13, 2014, at 14:06, somenath saha <saha.somenath.88@gmail.com> wrote:
> is it right?
> Let there are two client CLIENT-1 and Clinet-2. now suppose CLIENT-1 get an ticket from KDC in TGS_REP message as he want to communicate with CLIENT-2. now CLIENT-1 forward this ticket to CLIENT-2 in AP_REQ message. now CLIENT-2 must have right to decrypt the ticket to get the shared key.. am i right???
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
