[19346] in Kerberos_V5_Development
Implementing a PKINIT AS exchange
daemon@ATHENA.MIT.EDU (=?UTF-8?Q?oriol_ca=C3=B1o?=)
Tue Jan 19 05:53:28 2016
MIME-Version: 1.0
From: =?UTF-8?Q?oriol_ca=C3=B1o?= <oriol292@gmail.com>
Date: Tue, 19 Jan 2016 11:52:54 +0100
Message-ID: <CAGVdcvVW3zsY5YeqX83YL72Sz1Ss1rBfCLbMWN84ybrzpMKxDA@mail.gmail.com>
To: krbdev@mit.edu
Content-Type: text/plain; charset="utf-8"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello,
I am working on a project for the MIT kerberos, the wiki page is the
following one:
http://k5wiki.kerberos.org/wiki/Projects/Realm_Crossover_between_KDCs
I want to perform an AS exchange between two different KDCs, and I want to
do it using a sort of PKINIT exchange with Elliptic Curve, following RFC
5349.
I think this is currently not supported by the KDC, but it wouldn't be a
problem, because I am doing all the logic in a deamon that executes on the
same machine as the KDC. The deamon gets the requests from the KDC, which
redirects them.
My problem is, I couldn't find how to create an AS request in order to send
it through the Internet.
As far as I have seen, the initial AS exchange is performed with the set of
functions *krb5_get_init_creds_X. *This functions manage the AS exchange
internally, and it does not seem to be easy to adapt to my needs.
I may be wrong in my assumptions, I don't know the code that well.
What do you think should be my approach?
One of my ideas was to build the AS_REQ myself and send it to the KDC, but
this does not seem to be the approach taken by the *kinit *client, for
example, so I am not sure how to do it.
Thanks for your help in advanced.
Kind regards,
Oriol Caño
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
