Subject: RE: problem with message integrity of KDC-REP messages

From: "Medvinsky, Sasha (SD-EX)" <[email-masked]>
Date: Wed, 21 Feb 2001 20:09:23 -0500

As per my original email on this issue - I think that this problem needs to
be solved and it would affect a number of companies that are implementing
Kerberos for PacketCable security.
 
I would like to solve this now, while Kerberos revisions is still on the
unofficial sections last call.  I am open to any alternative solution
that accomplishes the same thing.  If someone has a better solution that
authenticates the contents of the full KDC Reply, please send it to the
list.
If the changes that Tom is making address this problem, that would be fine
too.

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: Wednesday, February 21, 2001 1:20 PM
> To: Medvinsky, Sasha (SD-EX)
> Cc: [email-masked]'; [email-masked]'; Cliff Neuman (E-mail);
> [email-masked]'
> Subject: Re: problem with message integrity of KDC-REP messages
> 
> 
> EVen if we do go forward with some change in this form, I believe that
> the ASN.1 you propose changing is already being significantly revised
> by Tom Yu, and you are inserting fields into the wrong structure.
> 
> I also object to any new instances of checksums being introduced into
> the data being checksummed.
> 
> I have not considered whether solving this problem is necessary; will
> do that later.  I'm simply pointing out that if we do choose to solve
> this problem, we will have to adopt an alternative solution.
>

---

From: Tom Yu <[email-masked]>
Date: 21 Feb 2001 21:27:00 -0500

>>>>> "SM" == Medvinsky, Sasha (SD-EX) <[email-masked]> writes:

SM> As per my original email on this issue - I think that this problem
SM> needs to be solved and it would affect a number of companies that
SM> are implementing Kerberos for PacketCable security.
 
I presume that they consider a denial of service involving modifiying
a KDC-REP to be more important than other sorts of denials of service
that may be easier to execute?

SM> If the changes that Tom is making address this problem, that would
SM> be fine too.

My current changes do not include modifying the KDC-REP, though they
could conceivably do so, since checksumming the padata would also be
useful for various purposes.

Basically, it would probably be best to create new types with new tag
numbers, and have some sort of "body" message that contains the
cleartext components of an existing KDC-REP and have a keyed checksum
be computed over the encoding of the.  The new KDC-REP2 message would
then contain the "body" message, the keyed checksum, and the encrypted
"EncPart".  This means that you don't have to modify the definition of
the "EncPart" and chew up more tag number space that way.

---Tom

---

From: Jonathan Trostle <[email-masked]>
Date: Wed, 21 Feb 2001 22:26:11 -0800

>the "EncPart" and chew up more tag number space that way.

Would backwards compatibility with existing clients be preserved?

Jonathan

---

From: Matthew Hur <[email-masked]>
Date: Thu, 22 Feb 2001 15:26:06 -0800

As long as everyone buys off on a new KDC-REP, this is fine with me.  My 
hope is that we can address this by the close of the next Kerberos working 
group meeting.

--Matt