[24682] in Kerberos
Re: AS_REP question
daemon@ATHENA.MIT.EDU (Chaskiel M Grundman)
Wed Sep 21 11:18:45 2005
Date: Wed, 21 Sep 2005 11:18:06 -0400
From: Chaskiel M Grundman <cg2v@andrew.cmu.edu>
To: kerberos@mit.edu
Message-ID: <71FD76C11C7845ED967E09E5@sphinx.andrew.cmu.edu>
In-Reply-To: <1127311623.787605.24750@g43g2000cwa.googlegroups.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Errors-To: kerberos-bounces@mit.edu
--On Wednesday, September 21, 2005 07:07:03 -0700 NetSteady
<cmhutch@gmail.com> wrote:
> In reading the RFC's it seems as though the encrypted data in the
> packet should be able to be decrypted if we have the proper password.
> However, the encrypted data changes with every attempt we send, and we
> can't figure out which variable is changing.
The contents of the EncryptedData is an EncKDCRepPart. The first item in an
EncKDCRepPart is the randomly chosen EncryptionKey that the KDC picked as
the ticket session key. In addition, the EncryptedData contains a
counfounder (a random block prepended to the plaintext in lieu of using an
initial vector in the cipher). The confounder needs to be stripped off as
part of the decryption operation (but, IIRC, after the checksum is
verified).
Also, have you verified your string-to-key transformation against the test
vectors in rfc3961?
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
