[25064] in Kerberos
Re: Interop/Compat: 3DES used in AS-REP despite no client support
daemon@ATHENA.MIT.EDU (Chaskiel M Grundman)
Tue Dec 6 16:51:39 2005
Date: Tue, 06 Dec 2005 16:50:53 -0500
From: Chaskiel M Grundman <cg2v@andrew.cmu.edu>
To: kerberos@mit.edu
Message-ID: <71CF8304E2388DA01D430472@sphinx.andrew.cmu.edu>
In-Reply-To: <1133899450.506985.218870@z14g2000cwz.googlegroups.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Errors-To: kerberos-bounces@mit.edu
The enc-part of the ticket only matters to the service that it will be
presented to (in this case, the MIT kdc). The MIT kdc is acting correctly.
the enc-part of the AS-REP itself is des-cbc-md5
> Later, when the XP machine approaches
> the Windows KDC about a service ticket, the Windows KDC rejects the
> request with an ENCTYPE error. I believe that this may be due to the
> inclusion of the 3DES encrypted block in the TGS-REQ.
This is probably because the krbtgt/A.A@X.X entry in the X.X realm includes
a key with the 3des enctype. You need to remove that key. I don't know how
to do that for an MIT kdc.
The client's enctype preference *only* affects the following:
- the enctype of any enc-part that the client needs to decrypt (which does
not include any enc part embedded in a ticket)
- the enctype of the session key.
The way that the kdc identifies what enctypes the server supports is based
entirely on what keys the server's principal has in the kdc's datbase.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
