Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

All life evolves by the differential survival of replicating entities. -- Dawkins


devel / comp.protocols.kerberos / Re: Query regarding S4U2Self protocol extension

SubjectAuthor
o Re: Query regarding S4U2Self protocol extensionVipul Mehta

1
Re: Query regarding S4U2Self protocol extension

<mailman.0.1629863336.450.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=122&group=comp.protocols.kerberos#122

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: vipulmeh...@gmail.com (Vipul Mehta)
Newsgroups: comp.protocols.kerberos
Subject: Re: Query regarding S4U2Self protocol extension
Date: Wed, 25 Aug 2021 08:42:03 +0530
Organization: TNet Consulting
Lines: 56
Message-ID: <mailman.0.1629863336.450.kerberos@mit.edu>
References: <CAMeQEL8+JGoqgh-j62duJBMLLoOKVPEZRWbC4mxLtdB-3ggwtw@mail.gmail.com>
<42a3d4b0-3461-5342-bf83-83475f3a0473@mit.edu>
<CAMeQEL_sJojTFJA0XWHNoVjPV-=_yGSMD7LpegF2QHR+PVC0Dg@mail.gmail.com>
<CAC-fF8S7PSPdFuVT31zEgkyiQ2WPyESRzY28FSOxSXh7=01rYw@mail.gmail.com>
<CAMeQEL9Wj1Wen2z6+xC2F9na7dn79MGrH9ARzzigsZj3kst1kA@mail.gmail.com>
<CAC-fF8RhhW2hUm28K4fXMbp-y4_ykkeZQyQFJvQn+AZa__zrBQ@mail.gmail.com>
<CAMeQEL_f7M0AiQoK3feZCFKPytZ93tMX6L7-KvupXr=8yVcEEA@mail.gmail.com>
<CAC-fF8QB4sE=1yAZDySViW5EZkV7b77F5yO08DhWw2c4jdPh7A@mail.gmail.com>
<CAMeQEL9PsKHvPBYb7mZBqRQxScwd8YNVBudYNCjcus8ibd66xg@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="13778"; mail-complaints-to="newsmaster@tnetconsulting.net"
To: kerberos <kerberos@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=mHTqRp1xHRgq79HC4egRHaSQmMA8oWMZ6UDcYrYPNbQlXvaikv/73kEj/pbDCbLe1wjjUbRz3TIGBWVLOgy9qg6lf/hYVCAHMHLTZbt889mqhB52TdrRBJ70yUxlNB+nMnVdcXS+1gnCxC4kR4svoqylEO2AveVDMsVU12H69Pz8dRgCtNnY5udm/9Tp2gBTpw8RlYeFGq/YIdpr3MsrVRKRoZAlzh1k1Z8GFVhyU81OuaHhacHuXQIT6Y4QhYXwOTfPgWuBfQwZ2FKEIqDtdYGYHm85/Ut5ICD858R6+dQAOasik0KtsKVpRV6dhDk+fQ6zzX+H1IsIx5kyP0IQlw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=aaTxZCE400kPc8BWP1b1hW3ECu3TUBBfNkYitFpgbwU=;
b=bJZ/LD9+1qcG0DY+RNcorU9PZzwXqoyb5wKpXJVoDGTC3pzNKCrpc7kt01CMROjz8QTbfofF1Wsz8D7yVNkiF6/j1fg422HOSap3OCBNpqToEB/dB9046i3YfyraNLuDMhk7daMoP197r5NQiY1fdPjit2yOjdMvTZ0hcH7kyGYpkaRQO6skEzdHYk81HNtWd61ZXkXnML5g6x9RQZEHKEhGfmaMyMFtjFFEkJPD5Re0BZSSV0iKrqKcz1qKP+BYEOfw6FPivxQ17y+BWyQu5ignfSUgXBc766g8Y0ptsOAnR/pSCaslNQugIHHFdzCV1zoQfTnuwnXgjqr5esGIPA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=aaTxZCE400kPc8BWP1b1hW3ECu3TUBBfNkYitFpgbwU=;
b=EbFF+CB0uW5sguUHs2Ht/4c33lDkHEH7MEm1WpBsPKRybxB8ZlcNQ8r+MX+2Y9ZtiQMRGifIUMc84n5JnxkvIzz2Xs8gsZYzMFaD+wO+YE9CSKNYm89lK0R0rIpx74oVzh/veTpY1IFVzDu3Admf7PXJlQJzT2CQhf2AvpNdYaM=
Authentication-Results: spf=pass (sender IP is 209.85.166.170)
smtp.mailfrom=gmail.com; mit.edu; dkim=pass (signature was verified)
header.d=gmail.com; mit.edu;
dmarc=pass action=none header.from=gmail.com;
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.166.170 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.166.170; helo=mail-il1-f170.google.com;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to
:cc; bh=aaTxZCE400kPc8BWP1b1hW3ECu3TUBBfNkYitFpgbwU=;
b=ET0SGi4p8hEAYUKkYRJ8sxA8+DnaBNN+cR9nIe7FDDubZpDbw8cfuh1lUJjWgnKKny
S6dehF2wsWQ5SpLg8QEbjs8ST2jYe63WRprv76AcrYQJLXWT/uI0me9BhTGeG4w4KhnE
Ih8F2B+7Em68CtjBdt114DFZdyPmrgVwAdtCTsamsxFIzbr8wwEXBs9w/mnEK3Ik0eGR
EGDBELkqKhX1n7COccfmWnTrw7TIg4N1tdG0eBvc46Ih2De+czjJaMGRUkFU9BvjKkrN
pckDXW+hrOfa0pwcZH54wdGtmv93bWnpLpkrfvpiLndr/CaqAfjANWBiE3b/zSwIwbDh
HrdQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to:cc;
bh=aaTxZCE400kPc8BWP1b1hW3ECu3TUBBfNkYitFpgbwU=;
b=pQd02C3EkSvUh/ToI/iBocVoDtKPECPTS3vWDiTAvzmjKQaqVxX57bWWGrKOAERc/P
UvmrgnKDNBkvKfKgrySYYKfh5u4Qb0c+Bb7l7VvRLg7Tv2yq2BA9bxgia4ATVe5/d4M0
N3rrzHei4PYej3n2Rrv9Lea2AgOqYGzdPcFm1oGSCXfEtzPohBvs3TJhxCGusjwyCgid
qI//13McSVCnDXbZ/B7Y2vrTtdY0SpFv//QipmQa5SzBHklNiccm9r5S+OoDH3KMDoBe
XiSpVlP1QUNbTrACbglRwCYj1bO9eb5AXNHoBA1qrfMYTNbOOb32XJH7/0IZ1PzW0FJo
FsJQ==
X-Gm-Message-State: AOAM530Dyk1CuRle4hAw2TQLOXiLQPgH49PBrogmcKtSuJpuSZccnnjK
CFmKLfUiV+hdxGUC+0o1f7aYq2pc5CvZd/giOZcUc+Ws2+6fzw==
X-Google-Smtp-Source: ABdhPJwtuJnWLSqju9k0C3lA+KTGwhG3hKNXJc4/Z4lvAcU4xXMvBzNN3mAQasHO79f2xCj7/dysWTFNGCLEKul/8q8=
X-Received: by 2002:a05:6e02:503:: with SMTP id
d3mr29505693ils.107.1629861134178;
Tue, 24 Aug 2021 20:12:14 -0700 (PDT)
In-Reply-To: <CAMeQEL9PsKHvPBYb7mZBqRQxScwd8YNVBudYNCjcus8ibd66xg@mail.gmail.com>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: bfe8165b-3e1c-415b-fb78-08d9677623a9
X-MS-TrafficTypeDiagnostic: BYAPR01MB3974:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <BYAPR01MB397490FDE84B71F2D1CD4D14FFC69@BYAPR01MB3974.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: EHxEoWsamrsW4jGl3nODsfe68gHErgW982v5w9vI4bOtKNJZTav5JORlWtLJDcnv8NAdY0EEAkDLC+TGJ3UJSRZN9UKE/JvBCRjXVK7E9nvsEtRyFAer0gVeZbbejlv6Rfd1pG1SHHXd3BiAtB6bYxnqeAWVVPZ7kQWrHdAiS0zUllHEyW8pLItidAMCb3dQ9duk9ZyjlDkKRKprdKgGW17AZ6HKWJqo744rNyUzG4PnMko4IVIyVoRjHLJ2hWSis4HxuE0TvNeZ0kpyPKKv4iSBMPdbwXjbSLWRtXwZovDVprj5dJovhUtYLF/cpNTDYRywbSbFkBPgXvYa8teavunisiB0Us4FOlSNfWaYk3/npcSE/x1slwEzZUlqLmFpfF2A9E7M8BSnO/AV3gjwFV3cwr4DbEebbfd8ugIUWsIu+cOWUQv3nrUWWKxMmJW7TslwdLNBokuKmKXqBboDSQ3QNJ7mIKw5v3t3F8DESvtaC3YcGRmdfnFZP/3ZxXx/vEyPOwrSHeaibwNhDG6aMgXHSq4nkIk3lFChyUHxuFLlve/cpcAtSLVgnofIpu8AU0ucBXifB+38w7wjJqZcJWNn+2kUqCoNLn3xoRNFs2a6zRZKCHSRnYBfIOEq2DUm/z6XYvvwFMETqDgLu6CrItIe7a9blWVrW/+t51G+5HrdR093eu9deYVH0wIpAaKagUVqWbcd2DTceiTmX+7ndDlNGdTg9sPQ516oCXXeVL0=
X-Forefront-Antispam-Report: CIP:209.85.166.170; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mail-il1-f170.google.com;
PTR:mail-il1-f170.google.com; CAT:NONE;
SFS:(4636009)(376002)(136003)(396003)(39860400002)(346002)(7596003)(86362001)(26005)(8676002)(68406010)(53546011)(76482006)(498600001)(336012)(70586007)(55446002)(7636003)(33964004)(82202003)(5660300002)(6862004)(356005)(166002)(54906003)(786003)(83380400001)(2906002)(73392003)(316002)(42186006)(45080400002)(4326008)(6666004)(966005)(107886003);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2021 03:12:15.1750 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: bfe8165b-3e1c-415b-fb78-08d9677623a9
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT032.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR01MB3974
X-OriginatorOrg: mitprod.onmicrosoft.com
X-Mailman-Approved-At: Tue, 24 Aug 2021 23:48:55 -0400
X-Content-Filtered-By: Mailman/MimeDel 2.1.6
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Vipul Mehta - Wed, 25 Aug 2021 03:12 UTC

Hi,

I have one more query on this based on following statement in microsoft
document:

"If a non forwardable S4U2self-generated user's service ticket for a
nonsensitive user is used, then the SFU client SHOULD<11> locate a
DS_BEHAVIOR_WIN2012 DC ([MS-KILE] section 3.2.5.3) to send the request."

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/ddb2cafd-1f01-4834-b52a-d4a5b34cd960
<https://urldefense.com/v3/__https:/docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/ddb2cafd-1f01-4834-b52a-d4a5b34cd960__;!!KpaPruflFCEp!xs7LC6xF-p5noCT18UnibXxKXcrNUf6GDk_BArh2V7T3TRWFgGLo5IL9RlB1cVwEOw$>

Is this implemented in the MIT Kerberos client ?

On Thu, Jul 29, 2021 at 2:20 PM Vipul Mehta <vipulmehta.1989@gmail.com>
wrote:

> Thank you.
> This was a useful discussion for me.
>
> On Wed, Jul 28, 2021 at 4:36 PM Isaac Boukris <iboukris@gmail.com> wrote:
>
>> On Wed, Jul 28, 2021 at 1:46 PM Vipul Mehta <vipulmehta.1989@gmail.com>
>> wrote:
>> >
>> > Now we know that behavior is unified and S4U2Self ticket should be
>> forwardable to avoid vulnerability, i think we can add a check in MIT
>> Kerberos API itself such that before sending S4U2Proxy TGS-REQ to KDC, if
>> ticket is not forwardable it will fail in client itself.
>> >
>> > I can see that JDK has this check:
>> >
>> https://github.com/openjdk/jdk/blob/739769c8fc4b496f08a92225a12d07414537b6c0/src/java.security.jgss/share/classes/sun/security/krb5/internal/CredentialsUtil.java
>> -> line 105
>>
>> MIT used to have that as well before RBCD was added, although I don't
>> think this was ever necessary, as that check should be done in the
>> KDC. Also disabling NonForwardableDelegation can be a valid usage when
>> relying on SIDs and not using protected-group, as in the original RBCD
>> design:
>>
>>
>> https://github.com/MicrosoftDocs/windowsserverdocs/blob/master/WindowsServerDocs/security/kerberos/kerberos-constrained-delegation-overview.md
>>
>
>
> --
> Regards,
> Vipul
>

--
Regards,
Vipul

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor