Subject: Re: [Ietf-krb-wg] Information Model: aliases and keys

From: Luke Howard <[email-masked]>
Date: Sun, 4 Jan 2009 16:22:20 +1100

> Are you sure you made the distinction between "same salt" and "same
> salt algorithm"? Recall arcfour has no salt.
>
> Also, the Active Directory attribute that stores keys only contains a
> single field for the salt. See [MS-SAMR] 2.2.10.4.

Sorry, I was wrong here; the most recent revision of [MS-SAMR]  
indicates that AES keys are stored in a different container within  
supplementalCredentials (KERB_STORED_CREDENTIAL_NEW). So, it's  
possible for AES keys to have a different salt to DES keys in Windows  
(although I'm not sure if that is ever the case).

-- Luke
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 07 Jan 2009 15:51:30 -0500

> (although I'm not sure if that is ever the case).

Can someone who's been following this discussion more closely than I please 
give me an idea of where we are on this issue?

-- Jeff

---

From: Luke Howard <[email-masked]>
Date: Thu, 8 Jan 2009 10:04:27 +1100

On 08/01/2009, at 7:51 AM, Jeffrey Hutzelman wrote:

> --On Sunday, January 04, 2009 04:22:20 PM +1100 Luke Howard <[email-masked] 
> > wrote:
>
> Can someone who's been following this discussion more closely than I  
> please give me an idea of where we are on this issue?

Larry tells me the computation of the salt name has not changed since  
Windows added AES support.

So, effectively, the salt is associated with a canonical principal  
(although in Windows the canonical naming principal and the canonical  
salting principal may be different).

--luke