Skip Menu |
 

History Show all quoted text — Show full headers
# Wed Oct 23 13:48:56 2002 hartmans (Sam Hartman) - Ticket created
To: krb5-bugs@mit.edu
Subject: password history should use master key
Date: Wed, 23 Oct 2002 13:48:53 -0400 (EDT)
From: hartmans@MIT.EDU (Sam Hartman)
Download (untitled) / with headers
text/plain 120B


Having kadmin/history be used to store password history seems silly.
Why not use k/m like we do for everything else.
# Wed Apr 04 16:47:26 2012 ghudson@mit.edu (Greg Hudson) - Comments added
Download (untitled) / with headers
text/plain 438B
Nico also notes that it would be more efficient and more reliable to use a
single, well-defined transformation of the password (maybe s2k in the
master key's enctype?) instead of storing key sets. That way, password
history would continue to work in the face of changes in the key enctype.

I'm noting this here because migrating to using the master key would be a
good opportunity to also change what key transformations are stored.
# Tue Dec 16 10:51:40 2014 ghudson@mit.edu (Greg Hudson) - Comments added
Download (untitled) / with headers
text/plain 459B
A user asked if the KDC could check preauth attempts against old keys
and avoid incrementing the failed authentication counter if they match:

http://mailman.mit.edu/pipermail/kerberos/2014-December/020409.html

I mention that here because (1) this issue would save the KDC from
having to keep around the history key in order to do this, and (2) we
would have to keep around the old keys, not a specific transform of the
old password, in order to do this.