The KDC uses the first local TGT key for the privsvr and full PAC checksums. If this key is of an aes-sha2 enctype in a cross-realm TGT, a Microsoft KDC in the target realm may reject the ticket because it has an unexpectedly large privsvr checksum buffer. This behavior is unnecessarily picky as the target realm KDC cannot and does not need to very the privsvr checksum, but [MS-PAC] 2.8.2 does limit the checksum key to three specific enctypes. As a workaround, add a string attribute which can force the privsvr key to use a specified enctype using key derivation when issuing tickets to that principal. This attribute can be set on cross-realm TGT entries when the target realm uses Active Directory and the local TGT uses an aes-sha2 primary key. ticket: 9089 (new)
Very occasionally a test using expired tickets will fail because the ticket isn't seen as expired. Obtain tickets with a longer expiration margin to avoid these failures.
A paper by Tom Tervoort noted that computing the PAC privsvr checksum over only the server checksum is vulnerable to collision attacks (CVE-2022-37967). In response, Microsoft has added a second KDC checksum over the full contents of the PAC. Generate and verify full KDC checksums in PACs for service tickets. Update the t_pac.c ticket test case to use a ticket issued by a recent version of Active Directory (provided by Stefan Metzmacher). ticket: 9084 (new)
A paper by Tom Tervoort noted that rc4-hmac pre-hashes the input for its checksum and GSS operations before applying HMAC, and is therefore potentially vulnerable to hash collision attacks if a protocol contains a restricted signing oracle. In light of these potential attacks, begin the functional deprecation of DES3 and RC4 by disallowing their use as session key enctypes by default. Add the variables allow_des3 and allow_rc4 in case negotiability of these enctypes for session keys needs to be turned back on, with the expectation that in future releases the enctypes will be more comprehensively deprecated. ticket: 9081
To facilitate negotiating session keys with acceptable security, assume that services support aes256-cts-hmac-sha1 unless a session_enctypes string attribute says otherwise. ticket: 9075
If the dump file size does not fit in 32 bits, encode four zero bytes (forcing an error for unmodified kpropd) followed by the size in the next 64 bits. Add a functional test case, but only run it when an environment variable is set, as processing a 4GB dump file is too resource-intensive for make check. [ghudson@mit.edu: edited comments and commit message; eliminated use of defined constant in some cases; added test case] ticket: 9053 (new)
If a kdcpreauth module fully replaces the reply key during an AS request, pass the reply key as the replaced_reply_key input to issue_pac(). In Windows environments this is used to provide an NTLM hash to the LSA when the client cannot be presumed to have a password to derive it from. To test this, add a fake PAC_CREDENTIALS_INFO buffer to the PAC in the test KDB module, and alter adata.c to display the set of PAC buffer types when a PAC is present. ticket: 9050 (new)
Add the global variables pkinit_enabled and pkinit_certs. Add the realm flag pkinit=True. Add the realm method pkinit(). Use these facilities in t_pkinit.py, t_certauth.py, and t_authdata.py.
Remove all of the AD-SIGNEDPATH code. Instead, issue a signed minimal PAC in all tickets and require a valid PAC to be present in all tickets presented for S4U operations. Remove the get_authdata_info() and sign_authdata() DAL methods, and add an issue_pac() method to allow the KDB to add or copy buffers to the PAC. Add a disable_pac realm flag. Microsoft revised the S4U2Proxy rules for forwardable tickets. All S4U2Proxy operations require forwardable evidence tickets, but S4U2Self should issue a forwardable ticket if the requesting service has no ok-to-auth-as-delegate bit but also no constrained delegation privileges for traditional S4U2Proxy. Implement these rules, extending the check_allowed_to_delegate() DAL method so that the KDC can ask if a principal has any delegation privileges. Combine the KRB5_KDB_FLAG_ISSUE_PAC and KRB5_FLAG_CLIENT_REFERRALS_ONLY flags into KRB5_KDB_FLAG_CLIENT. Rename the KRB5_KDB_FLAG_CANONICALIZE flag to KRB5_KDB_FLAG_REFERRAL_OK, and only pass it to get_principal() for lookup operations that can use a realm referral. For consistency with Active Directory, honor the no-auth-data-required server principal flag for S4U2Proxy but not for S4U2Self. Previously we did the reverse. ticket: 9044 (new)
If the target server principal is a host-based service without multiple dotted components and no default realm is configured, krb5_cc_select() can fail, and therefore gss_init_sec_context(). Continue without filling in the realm in this case. [ghudson@mit.edu: edited commit message and comment; slightly adjusted flow control] ticket: 9042 (new)