[33635] in Kerberos
Re: AP_OPTS_MUTUAL_REQUIRED only when using sendauth/recvauth?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Sat Jul 23 23:23:37 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E2B8598.2050800@d6.com>
Date: Sat, 23 Jul 2011 23:23:30 -0400
Message-ID: <1311477810.23877.210.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Sat, 2011-07-23 at 22:38 -0400, Chris Hecker wrote:
> It looks like I should pass it since this if-statement exists, yes? I'm
> still a security noob, but I'd assume it wouldn't be there if it wasn't
> important?
For protocol conformance, you should probably set the flag. But I don't
think anything will go wrong if you don't. The conditional you found
will erroneously decide to initialize the local sequence number based on
the remote one, but krb5_mk_rep() will overwrite that anyway.
> Also, a related question, if you're using AP_OPTS_USE_SUBKEY,
> sendauth primes the prng a bit more manually...should I do this in my
> app?
Ideally this should be unnecessary, as we can seed our PRNG from
OS-level entropy. The caveat is that our Windows code for obtaining OS
entropy doesn't appear to work on XP (it works on 7; I'm not sure about
Vista), but I hope we can fix that.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
