Ticket History #7033: krb5 1.10 KRB5_PADATA_ENC

# Wed Nov 30 15:44:09 2011 "Arlene Berry" <aberry@likewise.com> - Ticket created

From:	Arlene Berry <aberry@likewise.com>
To:	"krb5-bugs@mit.edu" <krb5-bugs@mit.edu>
Subject:	krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working
Date:	Wed, 30 Nov 2011 19:06:52 +0000

Download (untitled) / with headers
text/plain 687B

Download (untitled) / with headers
text/html 2.1KiB

I pulled in the tip of 1.10 last week to try it out. I’m seeing a problem with the KRB5_PADATA_ENC_TIMESTAMP preauth type. We call krb5_get_init_creds_password after setting the preauth list to KRB5_PADATA_ENC_TIMESTAMP and it’s reporting a loop error. I debugged into it and verified that it attempts to do the requested preauth type which fails causing the loop. I got down to lib/krb5/krb/gic_pwd.c at line 75 where krb5_get_as_key_password calls krb5_c_string_to_key_with_params and krb5_c_string_to_key_with_params reports bad enctype. I checked and the requested enctype is 0. The enctype is coming from the preauth rock where it’s also 0 and that’s as far as I got with it.

# Wed Nov 30 16:14:09 2011 ghudson@mit.edu (Greg Hudson) - Correspondence added

Download (untitled) / with headers
text/plain 861B

Issue #7013 may be of interest.

The looping itself is fixed by #6430, which will be pulled up to 1.10.
But that would just change the reported error in your scenario to
"Preauth failed." The real question is why, in your scenario, the
client doesn't determine an as-key enctype when processing the KDC
preauth-required error.

If this is a scenario which used to work, it's likely because the client
used to default to the first requested enctype when doing encrypted
timestamp. But if the KDC isn't sending an etype-info2 with that
enctype, it probably doesn't have a key to match against it, so that's
kind of a fruitless default (and one we've never had for encrypted
challenge). I'd be very interested in knowing if there's a scenario
where the default does actually cause authentication to succeed, and
what kind of KDC is on the other end.

# Wed Nov 30 16:46:43 2011 "Arlene Berry" <aberry@likewise.com> - Correspondence added

From:	Arlene Berry <aberry@likewise.com>
To:	"krb5-bugs@mit.edu" <krb5-bugs@mit.edu>
Subject:	RE: [krbdev.mit.edu #7033] krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working
Date:	Wed, 30 Nov 2011 21:45:58 +0000
RT-Send-Cc:

Download (untitled) / with headers
text/plain 573B

There shouldn't be a preauth required error. We ask for KRB5_PADATA_ENC_TIMESTAMP to avoid the no preauth/preauth required exchange so our first AS_REQ should have preauth data in it. We always set default_tgs_enctypes, default_tkt_enctypes, and preferred enctypes in our krb5.conf so it should have chosen the first one from the appropriate setting. I think without setting anything, it used to choose one from the library defaults but it's been a long time since I looked at that. This worked as of about early August with your trunk. The KDC is Active Directory.

# Wed Nov 30 17:25:44 2011 tlyu (Taylor Yu) - Ticket 7033 RefersTo ticket 6430.

# Thu Dec 01 11:45:54 2011 ghudson@mit.edu (Greg Hudson) - Correspondence added

Download (untitled) / with headers
text/plain 172B

Ah, optimistic preauth. Okay, yes, we should start with a reasonably
default enctype for that case. It should be a simple patch; I'll try to
commit it to trunk shortly.

# Sun Dec 04 17:38:37 2011 ghudson@mit.edu (Greg Hudson) - Given to ghudson@mit.edu (Greg Hudson)

# Sun Dec 04 17:38:38 2011 ghudson@mit.edu (Greg Hudson) - Target_Version 1.10 added

# Sun Dec 04 17:38:38 2011 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'review'

# Sun Dec 04 17:38:38 2011 ghudson@mit.edu (Greg Hudson) - Tags pullup added

# Sun Dec 04 17:38:38 2011 ghudson@mit.edu (Greg Hudson) - Correspondence added

From:	ghudson@mit.edu
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 953B

Set a default enctype for optimistic preauth

When the client application requests optimistic preauth for a preauth
type which uses the password, we don't have an etype-info2 to
interpret since we haven't talked to the KDC. So we need to guess an
enctype, salt, and s2k parameters. In 1.9 and prior, encrypted
timestamp contained code to use the first requested enctype in this
case, but encrypted challenge did not. In 1.10 prior to this change,
neither mechanism uses a reasonable default.

Set a default enctype in krb5_init_creds_init so that all
password-based preauth mechanisms will use a reasonable default in the
optimistic preauth case. The default salt and s2k parameters for this
case will be the principal-based default salt and the enctype-based
default parameters.

https://github.com/krb5/krb5/commit/3182d224286a5673d02eedf6847bb85dafca795d
Commit By: ghudson
Revision: 25504
Changed Files:
U trunk/src/lib/krb5/krb/get_in_tkt.c

# Mon Dec 05 19:07:11 2011 tlyu (Taylor Yu) - Status changed from 'review' to 'resolved'

# Mon Dec 05 19:07:11 2011 tlyu (Taylor Yu) - Version_Fixed 1.10 added

# Mon Dec 05 19:07:11 2011 tlyu (Taylor Yu) - Correspondence added

From:	tlyu@mit.edu
Subject:	SVN Commit

Download (untitled) / with headers
text/plain 1.1KiB

pull up r25504 from trunk

------------------------------------------------------------------------
r25504 | ghudson | 2011-12-04 17:38:36 -0500 (Sun, 04 Dec 2011) | 20 lines

ticket: 7033
target_version: 1.10
tags: pullup

Set a default enctype for optimistic preauth

When the client application requests optimistic preauth for a preauth
type which uses the password, we don't have an etype-info2 to
interpret since we haven't talked to the KDC. So we need to guess an
enctype, salt, and s2k parameters. In 1.9 and prior, encrypted
timestamp contained code to use the first requested enctype in this
case, but encrypted challenge did not. In 1.10 prior to this change,
neither mechanism uses a reasonable default.

Set a default enctype in krb5_init_creds_init so that all
password-based preauth mechanisms will use a reasonable default in the
optimistic preauth case. The default salt and s2k parameters for this
case will be the principal-based default salt and the enctype-based
default parameters.

https://github.com/krb5/krb5/commit/982264e339cc17b94db711c0926affd03a8b58da
Commit By: tlyu
Revision: 25524
Changed Files:
U branches/krb5-1-10/src/lib/krb5/krb/get_in_tkt.c

# Wed Dec 16 18:02:57 2015 tlyu (Taylor Yu) - CustomField pullup deleted

Ticket History #7033: krb5 1.10 KRB5_PADATA_ENC_TIMESTAMP isn't working