Received: from cathode-dark-space.mit.edu (CATHODE-DARK-SPACE.MIT.EDU [18.18.1.96]) by krbdev.mit.edu (8.9.3) with ESMTP id TAA22230; Thu, 17 Apr 2003 19:51:37 -0400 (EDT) Received: (from tlyu@localhost) by cathode-dark-space.mit.edu (8.9.3) id TAA21200; Thu, 17 Apr 2003 19:51:37 -0400 (EDT) To: rt-comment@krbdev.mit.edu Subject: Re: [krbdev.mit.edu #1415] subkeys fubar References: From: Tom Yu Date: Thu, 17 Apr 2003 19:51:36 -0400 In-Reply-To: ("Public Submitter via RT"'s message of "Thu, 17 Apr 2003 11:57:53 -0400 (EDT)") Message-Id: Lines: 40 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii RT-Send-Cc: X-RT-Original-Encoding: us-ascii Content-Length: 1519 >>>>> "Nico" == Public Submitter via RT writes: Nico> [tlyu - Wed Apr 16 19:40:57 2003]: >> Are there any applications currently depending on the functionality of >> unidirectional subsession keys? Nico> Er, well, I suspect not, but if the default mkr_req/mk_rep Nico> behaviour changes apps would break, no? What about older kcmd? Changing the default subkey negotiation doesn't break the AP-REQ/AP-REP exchange, since those messages only contain ciphertext encrypted using the ticket session key. They may break the state of what applications are expecting in terms of local and remote subkeys, though. kcmd applications use the local subkey on the client side and the remote subkey on the server side. This is just one key for bidirectional use. It seems that telnet does something similar to kcmd, but I haven't traced the code thoroughly. The GSS library also uses only one key -- the local subkey in the initiator and the remote subkey in the acceptor. To achieve "server subkey wins", we sould have to stomp on local_subkey in the client and on remote_subkey in the server. This might cause pointer aliasing nastiness, but is very probably manageable, given that the structure involved is supposed to be opaque. Nico> Is there a reflection attack there if unidirectional keys are Nico> not used? There is a reflection attack if you use a bidirectional subkey _if_ you don't utilize some other mechanism for identifying reflections, e.g. directional "addresses". ---Tom