[1767] in Kerberos_V5_Development
Re: protocol flaw (160 lines) (was: krbdev vs krbcore)
daemon@ATHENA.MIT.EDU (Michael Graff)
Fri Sep 20 14:56:40 1996
To: "Donald T. Davis" <don@cam.ov.com>
Cc: tytso@MIT.EDU, don@MIT.EDU, krbcore@MIT.EDU
From: Michael Graff <explorer@flame.org>
Date: 20 Sep 1996 14:55:44 -0400
In-Reply-To: "Donald T. Davis"'s message of Fri, 20 Sep 1996 14:39:31 -0400
"Donald T. Davis" <don@cam.ov.com> writes:
> if we
> knew a bad guy had already found this hole, i wouldn't
> recommend this "security by obscurity" approach.
> as it is though, by preserving the obscurity in krbv5,
> we can protect the security of v4's large installed base.
This was a well known problem when I was at Iowa State University, and
has probably been exploited by now. I would be surprised if it had not
been.
--Michael
