Subject: Clarification on KRB encrypted data checksums

From: "Louis LeVay"<[email-masked]>
Date: Thu, 31 Jan 2002 01:46:44 -0500

Looking at the detailed description in the Krb revision draft on the format
of  "des-cbc-md5" encrypted data types, the following is stated:

      +-----------+----------+-------------+-----+
      |confounder |   check  |   msg-seq   | pad |
      +-----------+----------+-------------+-----+

   One generates a random confounder of one block, placing it in confounder;
   zeroes out check; calculates the appropriate checksum over confounder,
   check, and msg-seq, placing the result in check; adds the necessary
padding;
   then encrypts using the specified encryption type and the appropriate
key.

However, when looking at the MIT code implementation (krb5-1.2.2 and
earlier), it appears that the checksum (MD5 hash in this case) inludes the
PAD (for the encryption block).

Is this implementation incorrect (and would lead to inter-op problems for
any Krb implementation that wasn't derived from an MIT code base), or should
the spec be updated accordingly (which I believe is currently undergoing
updates to the encryption/checksum section anyways)?

Thanks,
Louis