[33739] in Kerberos
Re: in_data/checksum in AP-REQ?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Aug 9 09:55:28 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E40E56C.7010400@d6.com>
Date: Tue, 09 Aug 2011 09:55:16 -0400
Message-ID: <1312898116.2110.41.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Tue, 2011-08-09 at 03:44 -0400, Chris Hecker wrote:
> What's the in_data for on an AP-REQ/mk_req? It gets checksummed and
> stuffed in the authenticator, but it doesn't seem to be used anywhere
An application can use this to checksum some data which is sent along
with the authenticator request. The receiving application would have to
use krb5_auth_con_getauthenticator() to get at the checksum and verify
it. It's not a widely-used feature of the protocol (well, the GSSAPI
mech uses the field, but not as an RFC 3961 checksum) and it's subject
to replay attacks because no subkey has been established, so you're
probably best off ignoring it.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
