Return-Path: X-Original-To: rt@krbdev.MIT.EDU Received: from biscayne-one-station.mit.edu (BISCAYNE-ONE-STATION.MIT.EDU [18.7.7.80]) by krbdev.mit.edu (Postfix) with ESMTP id C79DDCC8D8 for ; Tue, 19 May 2009 22:24:48 +0000 (UTC) Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103]) by biscayne-one-station.mit.edu (8.13.6/8.9.2) with ESMTP id n4JMOl2Y001846 for ; Tue, 19 May 2009 18:24:47 -0400 (EDT) Received: from cathode-dark-space.mit.edu (CATHODE-DARK-SPACE.MIT.EDU [18.18.1.96]) (authenticated bits=56) (User authenticated as tlyu@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.6/8.12.4) with ESMTP id n4JMOkKm022860 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 19 May 2009 18:24:46 -0400 (EDT) Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.12.9.20060308) id n4JMOki5001721; Tue, 19 May 2009 18:24:46 -0400 (EDT) To: rt@krbdev.MIT.EDU Subject: Re: [krbdev.mit.edu #6490] [Russ Allbery] Bug#528729: libkrb5-3: cannot obtain cross-realm tickets with Windows 2003 AD References: From: Tom Yu Date: Tue, 19 May 2009 18:24:46 -0400 In-Reply-To: (Greg Hudson via's message of "Tue, 19 May 2009 01:32:37 +0000 (UTC)") Message-ID: Lines: 39 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Scanned-BY: MIMEDefang 2.42 X-Spam-Flag: NO X-Spam-Score: 0.00 RT-Send-Cc: X-RT-Original-Encoding: us-ascii Content-Length: 1975 "Greg Hudson via RT" writes: > Here is what we know right now: > > 1. If you use a keyed checksum with RC4 keys and an authenticator subkey > in a TGS request, AD 2003 verifies the checksum using the subkey. It > turns out that RFC 4120 doesn't specify what key to use for AP-REQ > checksums, but Heimdal and MIT use the TGS session key. RFC 4757 > (Microsoft's own informational RFC about RC4-HMAC) says to use the TGS > session key, so MS is in conflict with its own documentation if not with > the binding standards. > > What we don't yet know for sure is whether this problem affects AES. We > need to find that out to know the appropriate scope of the fix. If the > problem affects only RC4, then the appropriate answer is probably "don't > use keyed checksums with RC4, it hurts." If the problem affects AES as > well, then it gets more involved. Confirmed that the keyed checksum problem does not appear on Windows Server 2008 SP1 with AES-256 keys. Also, the RC4 keyed checksum failure does not occur on Windows Server 2008 SP1, so I can infer that Microsoft considered it to be a bug and fixed it on Windows Server 2008 SP1 (or maybe even before SP1). > 2. RFC 4757 erroneously documents a key usage of 8 for a TGS-REP > encrypted part authenticated with a subkey; the value used by MS is > actually 9. Unfortunately, Heimdal and MIT both implement what is > documented. This means you can't interoperate with both {Heimdal or MIT > 1.6} and AD with RC4 TGS subkeys using a single key usage value. It's > easy enough to try both when decrypting the response, however. > > Sam has committed a change to switch from 8 to 9, fixing TGS RC4 subkey > interoperability with MS but breaking it with Heimdal and MIT 1.6. We > will need to amend this to try both usage values. Confirmed that Windows Server 2008 SP1 appears to use key usage 9 for TGS-REP encrypted part with RC4. (Fails before r22355 change, succeeds with r22355.)