[24766] in Kerberos

home help back first fref pref prev next nref lref last post

Re: AS_REP question

daemon@ATHENA.MIT.EDU (Markus Moeller)
Thu Sep 29 17:27:46 2005

To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Thu, 29 Sep 2005 22:22:57 +0100
Message-ID: <dhhm09$eg4$1@sea.gmane.org>
X-Complaints-To: usenet@sea.gmane.org
Errors-To: kerberos-bounces@mit.edu

Maybe this helps (from
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/4a1daa3e-b45c-44ea-a0b6-fe8910f92f28.mspx )

Markus

KRB_AS_REP Message Contents



The message includes:

      . A TGS session key for the user to use with the TGS, encrypted with
the user key derived from the user's password.

      . A TGT for the KDC in tailspintoys.com, encrypted with the TGS key.

      The TGT includes:

            . A TGS session key for the KDC to use with the user.

            . Authorization data for the user.


      The authorization data includes:

            . The SID for the user's account.

            . SIDs for security groups which the user is a member of in the
domain tailspintoys.com.

            . SIDs for universal groups in the enterprise that include
either the user or one of the domain groups the user is a member of.



When the client receives the KDC's reply to its initial request, the client
uses its cached copy of the user key to decrypt its copy of the session key.
It can then discard the user key derived from the user's password, for it is
no longer needed. In all subsequent exchanges with the KDC, the client uses
the TGS session key. Like any other session key, this key is temporary,
valid only until the TGT expires or the user logs off. For that reason, the
TGS session key is often called a logon session key.




"NetSteady" <cmhutch@gmail.com> wrote in message 
news:1128018776.867930.271990@g44g2000cwa.googlegroups.com...
> I'm actually speaking about the enc-part of the Kerberos packet itself,
> not in the ticket. Is this the part you were speaking of?
>
> Our problem is that we're trying to validate the password for the user
> when we receive the AS-REP packet, but for some reason, we cannot find
> where to get the encryption key for the enc-part. We've read the RFCs
> (many many times) and are still having issues finding this.
>
> Suggestions?
>
> ________________________________________________
> Kerberos mailing list           Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 


begin 666 trsc_krb_117c.gif
M1TE&.#EA`@'F`/<``/D-$.\#">PG,-\&$]\3(.4S0,\)'-] 4-A-8+\,)M):
M<*\/+\QF@)\3.9D@2<5SD)\Y8'\93'\93;^ H&\<5KB-L%\?7U]97U\@8']-
M@+*9P$\C:3\F<S\F<JNFT"\I?!\LAA\LA4]2::6SX \OCS],<A\_A2]&?+"_
MW\#,YN#F\]_E\@`SF0D\GPH\GP\_GQ _GP\YCQ],I2!,I2]9K#!9K#]FLD!F
MLD]RN%!SN5]_OV!_OW",QF^,Q7^9S("9S(^ETI"FTJ"SV9^RV*^_W[_,Y=#9
M[,_8Z_#S^>_R^ `YGQ-&I0`_I0\_CSELO]_K_^_U_P!F_P!&K ]O_Q]Y_R^"
M_S^,_T^5_U^?_V^H_W^R_X^\_Y_%_Y_ \*_/_[_8_\_B_Q]+AG^U__C[_Q],
MA;_;_P!Y_]_K^/+X_V^U_W^__YG,_Y_/_[C;_[_?_\7B_\SE_]+H_]CK_]_O
M_^7R_^OU_P""_Q^2_S^B_T^L_U^R_P",_P^/_P^2_R^?_S^E_S^H_R]9?&^\
M_Z_;_P"/_P"2_P^9_^CU_^_X_P"5_P"9_P^?_Q^E_R^L_S^R_T^X_U^\_U^_
M_V_%_X_2_Y_8_Y_/\*_?_[_E_\_K_]_R_W_,_S]E<S]F<J72X$^XL*O5T$]R
M:5^_H++8P'_,@%]_7[C<L&^,5K_?H)_88'^93,7BD*_?4,SE@+_E0)FO2=+I
M<)^R.=CL8*^_+]_R(+_,)M_O4.7R0,_8'.SV,._R"?G\$-_E$___`/_SX/^9
M`.^2"?^?$-^,$_^E(,^%'/^L,/^R0/^Y4/^_8/_&</_,@/_2D/_9H/_?L/_F
MP/_LT/_Y\+]_)J]Y+Y]R.8]L0G]F3&]?5O\``/] 0/]04/^ @/^PL/___P``
M`/___P``````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````````````"'Y! $``-T`+ `````"`>8```C_`+<)'$BPH,&#
M"!,J7,BPH<.'$"-*G$BQHL6+&#-JW,BQH\>/($.*'$FRI,F3*%.J7,FRY38<
M+&+*G$FSILV;.'/JW,FSI\^?0(,*'4HTJ(Z#+-8H7<JTJ=.G4*-*G4JUJM6K
M6+-JW<JUJU862+V*'4NVK-FS:-->!6LP*50/#QA4&*&VKMV[>//>95O0;5,%
M`*P)%@Q@@M[#B!,K/LR7H%^E71@,'I# P&##BS-KWLQY:N.!C]=HZ/+ `0F9
M)"Q;P]RYM>O7>#\+##T"P8"8-&S88)%:L ?8P(,+YRI[6V@!U@)0."IPR(O>
M!89+GTZ=:?''&I)_8.%CVPJ!1UZ$_Q!<H;KY\ZZO,U5@+0(+&T<0;3MR!I,/
M%@NL'4#/OW]B]4L58$T'8*%1QQMR;'-)$2Q\$( U'!0EX8045FCAA1CRY(14
M`"HE((';6#*&&VO (1 0+$1@30:*M.CBBS#&*..,--9HXXTXYJCCCCSVZ../
M,H;65(=K? B6(H]D4D<<H*G((I!01BGEE%16:>6/0EH75H #'MFB)@)M89R3
M5Y9IYIEHIFEEEDL1:>0V+PH4Q9@KJFGGG7CF>2:;2KG9)9PNRDFG!!D6:NBA
MB";ZDQ0P\KF&GQNPL,(ECK0H:(K69./2IIQV6A$+C7*XI5((6+,`"R_XD 2E
M`DU!IZ:>QO\JZZR.A1H5D14(MD (J*HZ$(,-9$KKL,2Z!.J+CA*Y1@6!6=,`
MKR_H)@,+%@BF3;'89EO2L2XF.^I2M0WV;$P=)" 8-MJFJVY'W+;H;5M0A3O8
M8-=<N^Z]^%+4KB+O]B45"! 0,!@&^19LL$/[]NL8AXU>% 0*!T<<:\*BPGMK
MPQ7=$-,,0DCL<4L4W_JM4PE7I (+./CP`@L<?^SR22%#I>R0&$^4`@LR;).$
MRBQ#_/+/(,7\U,S6U2S1S7SMO/(-*0#M]$9"DSPRS<A6A'1!2>@0$]-/=_VI
MK3)/7735%%UMT I:LW"#$5ZW_5#40XK=IM$1F7T0VBS H(+;?"O_!+>6%LM,
M-T17<V'%%P<=P<(/?3?>%MA#R]WGX ]=#8464QS>%N..=VX<Y%('/C3E#ME]
M^118/.$8YYXW_G>;DC]*>D.60R'0$UA$D?ILK#_$#4*_?\1-\" 1#_3K?<9>
M<MDQ;</%%%K8O@WN6O"NT/#8#W_]0L83A#WPQ?.-_*/*S\Z0V5]8`;WJJS?4
M/?C;PW_0^QK1?SSH<8M.LOD+V;W-%U?0'?N,T[N$&(]XW]L&`@7RO>S-CX$)
M=* "M<? "3HP@1 ,W@4'@D$)XFM\1)L;V6S6/"]$[W:YJQX!W>>]"E90@RY4
MH SAM\ 9VE"#,(SA^W(XPQK6\%X@+-\(_X_6O">H[X338]_B6,C!&+Z0@QND
M81-O.,4?6C&"5<RB$]451/U1K5M6:YY TH>Z`:Z0(0?<8@<+8K\>:I&*<(2C
M#]_(PS86JXO^NM@0ZR;&@8 A=[L[(_=:2,4<+K"-==0A':?H1A?.T9&,7!<>
M%Z9',#*O.-2S'AH):4%%=A*"!FG@&S\9QRM2<((W/.4/)8D_P.51<'N," Q2
ME02_%;!U;9LD:!@62X@880:HZL%WD')+7'9-E[/AI24M(@1@LD 'PVR?,<77
M2MAY<6S+O$@S8P)-:4XSE]5,WC5%F$V,"$%C*"N")K_I-60:1YGN\D@*T&F#
M'K"@8^QL9SC)-__.R?4R(_.,"0R0D$]](JMBKQS=/S5BA!3LK:#'W&<(_5E.
MB%JT(>Y,%O\NRE'02%2(%>VH2&MU4)'U4W8+'6E',PI/?JGTI23M%D(I"<N0
MPI2C+*UD/#&"#&#XXJ>^(,8Q;NJRG-9TIQ5YAC& RE1?&*,71)68415J4X<X
MPZ>^F(8(8E(":OSBI\N(ZL&FNK^4+N09PO!%,$Z &QNLS 3#^&DR.&(_.Z;$
MKB+!JT?(^D6D2B09:HT!"WI0R^:P( ;1^"DR)I(]##XP?@9T+$3TBD;)8HNO
MV/1K1(CABPNP8 @$><,<BK"R"_S4&171JUWMF$:)4!:R-LP69LFI68C__#0&
M,LC$(EK4"$S$H0TKH $+H.'49U"DM9_TH?8\R,D64C""T%TN%%5IV;H^%Y6'
MG*YVV?71DRYO(C]]SR4B<0E-M&@2=("#XDKP4V DP[@1:6UV&RE#1,Z/?K][
M9"GCZ+WN'=**],UO)#,R6XK6]B'AM<$E+N&%;42B19EPPQAV<X%@M!<94/4=
M(?V;2E%N%X'2[6^(`\Q(`6^QO],=\1/IF\%3:J3 **TJ0V[[`@5Y`0R(:-$E
MT$"'(^R&!14&ZC$RO,E1DI+#\ENQ(O4+X%4^%LE--"0;0P+C[TJD&+[8:A$F
M(9\<*V(;F-@&&L90A!]?@+@_'7*1(;GB1++6_[F<-#&)ESS@V+HYE(MT,D:J
MO-&$*,,7T'@/(AH1)T5$(A-C&'.9N8IF7QP#M0:,\W4=2=W(3CK%I92S<EV,
MZ0_C68?4?>W;NIO0LLKXK#XM`7<PL5L=*P(3FI $HM'@G;25`,W @*_C1'U9
M4M.4J@=^"&!_(=@A8((1+J($(C*!B%AC(M%CP!L+1/#5Q?;-LF/U]2YUZE*+
M8!D:@NW.@C%Q!-!>`A/-?L0EH+T"F(C@M&*5%9_-RI!G<'88@I5!#WR@@Y71
MH B(D,0E$$$)\H[!=L(EKC'"%^^(S/O4#7%&6G\Q#;;&) :>774C)$&);5!"
M$E#@`H-,\-/[<IHDR/]=J;:3R>WB2.09R `J-&;^U;6R0)U)D 0C.HZ(+SQ!
M:\2%="1Y?1$]7_3AP9Z(,YB15J!.7+ LH,$V$#'HCH,!)L1MQI1-OMWD?AC;
M/#QRG5VW\G>VW"/.:(;:T:I6$:B:!C0P=IAA<H*OZAJ*6Z]OWMFL]Q/+>;]$
M?QG2NQV2JP)5U;WJ][2_JHS(ICB_!Y1OE.OLV,9.WIB#=SE'FG$,+/\T&#-Y
M-S#".LC8XOWT=_:[)Z<<^**67:/TWL@RL#H,FH,UR8D<L)25O,-%CMUQF4_)
M,SP/U(5;.O(X!+$I5S_T#.Z]=<%72=K7[K'6N[ZD8?-NGU]J_>O+U*2E[BO_
MX1MNT>B3O_RO;ZGFSX]+\[,_G^Y__S?C+W_,I__L]6<G_?/ON<$S05$`&( "
M.( 5<G]'I2<(F( *N( XHC#;=H ,&($2.(%VXH L!X$4F($:N($^8H%FAX$<
M&((B.(+N,E,/.#0$F((JN((LN!,N8((7Z!\R.(.M,5$T>(,X:!<VF(,\V(-B
ML8,^&(1"6!5 .(1&>(36%'Y+\0FJP JET E(&(4^2#2OH N\<(57J NG((5<
M2(/*4@FL@(6[0 NW@(5;V(5HB![*(@J5H JNT 0RT01ER MGF(9V*!W*T@FQ
ML MMM1MR>(6?<(>"&!S*@@N\D NFP!S;X!Q_: N#__B(Z?$MHG"(@< =W@$>
M+T &5U@*D-B)FD$DK\ +J? >\3$?]7$?LL +M>")K/@?WV(+O, )8#$'=( @
M"L(@@9 +O+ )+=B+OOB+%K(AX/=KL"B+VY )=- &)7(B+) *O# *)!B-TJB 
M'O@8Q0@6BZ )F8 &"3(&QN&,T#B-XCB.:%*-3'&-@&)H`L$%W_B,Y/B.\#@E
MYK@4Z!@GVS GS>B.\;B/_*@C\Z@4]1@H]]B.X;B Z0@C!RF!"0DE"VDI_?A]
MV9=0L @*DD(IEC*0^5B0:G(0-=*0A=:1`_$C'JDC'$DC(QDHTOB/:Q +O" +
MO;(JCM J!(F )XF2'7F3-O_)(S5)DCBRDSLI@2I9"E<H"V3PDK_"`K"@CWER
MD.D8DE]FDR%)$#+2D' B$!<)*%+Y95$ID%9YE1[)E%SID&+IE%DI@BJY!J5@
MA;P`"T49+38P+:1PA9Y DQ_9E$]YEW8YDE1)E7>)ESF9ESF)D'6)DE@IEGX9
MC6>Y!GJ(A6P9$YQ "U>X"@D(EGWID$TIE4S9E9=9E0BYE6/YEX09F!_YF86V
MF9J9DC#X@4VQF%B(A:TPEY,YF/9HEZ,9(PG)F:!)F[39E[A9F;59F+,IFKX9
M@HG)%&& "K. A:' @)0)F(?YE"<)EI0)G5 )FI8IG(;YG+@)G,\Y@L5)6PHY
MFF3_"95=J94F.9ZSV9N7R9OD69Z"^9>G.9;NZ9X<^)T&]I D^)/X:2/V&6/[
MR8%.^9] TI_[(J &^I\$>J **J )NJ .VH\-^J 2^HX1VB+_!XP8FJ$:>A-*
M8(# -G[\!WT>:FI)%Z+4A'V1HWVQ9Z)/LW\L>J(0F:)*")[K]Z(1A:*A,Z/W
M6:,VZC0N&A'+8 S%,*3%@ RDUZ.S\J,/H0Q8U52-AZ3R-J+BQZ,*,7P_-0S3
M4 )=A6;"('10NBE*RA">5PTU06V^``Q:MQ%U%2O=5W0J$:8*L0R^\ ML10-$
M4$M'H#4G8&&^<*23U5AO!ELFUWIMVF*LA*/YHZ/^":(0_X%EU/!,! $':' ?
M,2 -9WIW\<5$D;:I)Z:IJ=5<O8:HKO1K),JH".8+)O "B/ (CN (DG (;A '
M1+ R%F9MC"5IN== 8/= S]6KOJII'51=P'-=(P:LRK=74II9INH0"48IFE I
MC' )<# '1 !D/U4,:9JI><9W?_=\H(1G3%9B_'5ZXJI*ES=?IK=GR4JC%=&L
ME@`&VU IBX (;; -TV*IU\H,VLIWO!=%SM=AIN>ON5=(OX=*+=:M)A9V%G1R
M%P&G"1%>,H (E[ %4( )7T('U/I6^.H+PN"GI<>O8@>JH/IWZ#JP)5MZ4-9F
M:D1EZ[JC%<%9JK8"DS ]<*()7/\F9DK#`B8@#5_%L1Z+>W1&8H&J9 3+K>5*
M>1MV>7$6M.G:L"V[J%2*$#$G#<^4":U*:)J@"3LG9FB0LS'@53_5L9BZ=\<J
M1Y4VK)=FJ%>T7PL[J"*F>J!6MASAL C1"S]E`BQ !);@(EFK" 77<6C0M4,P
M+5_;L\30.H7J*72+$,?@"\. *D= "2]R:!(;"1V7:(M(N-/P4T_*-]AF,(M[
M$&PW#:A2!)F0M9.0!"L@L1+[")J "(&;N2Q #9?ZI2PKJDE(JE-Z$89'M<]$
M!$4P!,)%6)C 99<@":]+:TE JX[&<$@:N@C!##\%#5LU$WC[`GJ["+*6"9(P
M"4_P!4/_P +L!0QNBQ(IAU-/:V45X0R<-:?4\+[$)0TQ\ *K&Z^'QFQ<``6[
M$5=$YD2)JV&=BGZX*TZ*JKX6H0PQUU2.BS,VH .(8 F6<&C_8T]9YZW_>F27
M%EWXY;_F&L P6H+#>(*E&K4/T0O*D PH;'C1`'4]T .1.[,H$@,6UK_?>K0C
MR[2]AUSH*J(#S$\%O'T5(:= A;<X$[PP`5=.Y7@':[ U++24YV*61[3]E[Y 
M7!'*T'3!``V^>W%?-50H>U\HYL1P:W3=VCG0:Q&-^U/3\+Z)Y0MS]5A&JWM&
MJV?A6K!]<\86L71-VEYCVVG_&JS+-ZYV=L$>?,=4O*(<\0PG_XS"^BHQ_PNZ
MAPQQ,/7(D-S#-FC MNNCD5RBF?PQ>-S)AQJC.:J[RDK"H)POGWS*VI+*JARJ
MHIRHI,RNK7P_E@Q2G#S+J+S)RUH11O #OOS+P!S,/Q $38/+4*/+IKP0*E #
M0L$#!&7,ZEK+*BK)#6$$, "I"@&O! $$+P`#/@/-7R/-/XS("B$$U^P#B-!J
M,@(F:5 (+1*M*[ ;-_!0X"P1K"P0/Q 3QD9H-=((F? %=^ BDH (W*PW]6S/
MR'P1^8R]K(8CBS )4& '+A*MU5I,!^TW"6T1P%0$EJ#.,I*-FD!HC/ $>9"U
MR!8)X1L$%PT1]]P\-N+/`C%HCO %<_]@L^FL"?=1S"N-41G]*5Y"(V$V$,LF
M!LCFMYB0";OQS#O-$"W]TS+2<04!!7S@(HN0">&;S!?=U![)"&!B$(,`(X@@
M7/BTU$S=T_KBU(K ".25$)#P(HZP`BS `^I"J$F6R^(<RRYK$2Y-U?*A$'_P
M(IK (#L`6XG+7)[ZL8+Z068]$7O=(I; $&! "!.-"#"ATY]6R YQOHB]V76M
MV'<MPKNKUTX-U0NA!B_R",L[4$![P5C$:1N\7% ,R(;:M@!;VURTV/;LU)'@
M$(#P(I0@V*L-99 'QV%<QR<[R*R'V<1RSS/P`DGP""_RV N!"'@@T(A0K8--
MW#@D8BHFLAW_EL%+K%_?W4.4;!+WG,\X,&@3O1"1D AQLAL&K=W%;<%-2\=&
M)MZIU\2KC-L2H3$]H%LM0MH(89LL4 /??-D!R[0(KFF^=]R2)\7E/1+WO U(
MP,S&I@@QN1 $;MGE2TI>=WP<C'QEN[;CG7R>_<JC"MJEG!'6S )'@&X+`08O
M\M HPN%DG1 3O@WYC"H,P0:&< D#D00_IM0WCM&?'8,CC!$G\P+[IA![@) R
M`0-C7>1&CN*YJ^*R;!$[P!U@H$((80;N'2@;PS947M9'KII);A%(<,U)8 5S
MDA!>H =Q0EHU0.1ECA#W' 3/] 11$ 5B@A!0``5^$"A0$+XY<.<+],'<+IX[
M?<Z.!Y$%6? $?6!H3T %3V!/%HWHGW/FL$?-"($"[P$%4]#G?7X%VCP06]#H
M92 (3U %45 %^LL"!Z[I'L7IZJ?E*",1I\Z,F7[GK"P$%S+KM+[I5D[ > VU
M%]'+PKSLS [,PC[L.3[L0</?TMXIT5[MW&7KW*8$&]KMWHZANCRAXDZ"%3KN
MYDZ<J=GIY[[N&ECN[/[N#.CN\#[O>M*?2_#M^)[O&MH"Z=Z*_HZ'L?/O`K\8
M13CP!A\;`7_P"J^#";_P#G\6!?_P$N\5$3_Q%I\5%7_Q&D\5UZ'O'O_Q("\3
0-8;M)%_R)G_R*#\K`0$`.P``
`
end


________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

home help back first fref pref prev next nref lref last post