Subject: [kitten] One question about Kerberos Protocol in the RFC 4120

From: bc a <[email-masked]>
Date: Wed, 18 Aug 2021 23:53:47 +0800

Dear Kitten members,

I'm Xiaoxing Xu and I'm a cyber security researcher from China. I had a
question about Kerberos v5 when I read the RFC 4120 paper, which expects
you to get your reply.
The question is, I see the "key" appears in the "enc-part" field in the
"tickets" chapter of section 5.3, just like the first picture shows, and
the "key" is used to pass the session key.
So we can think the authentication server creates a session key and put it
in the "enc-part" of the "tickets" field in the AS-REQ phrase.
Then in the  section 5.4.2, I found that there is also a "key" exists in
the "enc-part" of "KDC-REP",  that is to say, there is also a "key" in the
"enc-part" of the AS-REP phase,
not the "enc-part" of the "ticket".
So I want to know whether it can be considered that the authentication
server creates two "keys" in the AS-REP phase， one in the "enc-part" of the
"ticket" field,
and the other one is in the separate "enc-part" , And whether these two
"key" values are the same?
Thank you so much for your help.
Best regards
Xiaoxing Xu

---

From: "Derek Atkins" <[email-masked]>
Date: Wed, 18 Aug 2021 14:03:23 -0400

HI,

No session keys are ever the same.
Whenever the KDC creates a session key, it is supposed to be randomly unique.

The only time keys are "the same" is long-lived authentication keys, the
keys shared between the KDC and a user, or between the KDC and a service. 
Those long-term keys are used to encrypt the unique session keys.

Hope this helps.

-derek

On Wed, August 18, 2021 11:53 am, bc a wrote:
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Greg Hudson <[email-masked]>
Date: Wed, 18 Aug 2021 16:01:27 -0400

On 8/18/21 11:53 AM, bc a wrote:
> server creates two "keys" in the AS-REP phase， one in the "enc-part" of
> the "ticket" field,

The two key values are the same.  For an AP exchange to work, the ticket
session key must be available to both the client and the application
service.  The key field in the EncKDCRepPart is visible to the client,
while the key field in the EncTicketPart is visible to the application
service.

I see that Derek gave the opposite answer.  You can check the Heimdal or
MIT krb5 KDC implementations to see that the same key value is used in
both places.  In MIT krb5, the relevant lines are in src/kdc/do_tgs_req.c:

    enc_tkt_reply.session = &session_key;
    [...]
    reply_encpart.session = &session_key;

and similarly in do_as_req.c.

---

From: "Derek Atkins" <[email-masked]>
Date: Wed, 18 Aug 2021 16:22:21 -0400

Hi,

On Wed, August 18, 2021 4:01 pm, Greg Hudson wrote:
> I see that Derek gave the opposite answer.

I didn't *quite* give the opposite answer.  Every session key is unique. 
But you are correct that I was unclear on the fact that the KDC has to
transmit the same session key to the user and the service.

>   You can check the Heimdal or

-derek

---

From: bc a <[email-masked]>
Date: Thu, 19 Aug 2021 11:10:53 +0800

Thanks a lot for your clarification. I'll check the  MIT krb5 KDC
implementations later.Thanks again!😄😄