Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

There are two ways to write error-free programs; only the third one works.


devel / comp.protocols.kerberos / Re: master key type in kdc.conf

SubjectAuthor
o Re: master key type in kdc.confGreg Hudson

1
Re: master key type in kdc.conf

<mailman.3.1633281371.17806.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=154&group=comp.protocols.kerberos#154

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: master key type in kdc.conf
Date: Sun, 3 Oct 2021 13:15:46 -0400
Organization: TNet Consulting
Lines: 13
Message-ID: <mailman.3.1633281371.17806.kerberos@mit.edu>
References: <7dedcb59-f09e-54ed-a0ce-5b5aac3357d@prime.gushi.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="14000"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.11.0
To: "Dan Mahoney (Gushi)" <danm@prime.gushi.org>, <kerberos@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=K1w/ozUKTzzFC6a58p4w1BsolnjrYBHyyDLzdjoGlxENeAyYF2w+jZ60FT2XAfHZLJF+hUrYH5C5cfT6sb70mjOBW1lpWY0baM3Qp1b91XctDxUQS8hA2YSZPfjoOcNm+Io2juS0bBM0A2nU+GLecd/pN3T8hq2enYQzn7I6+sALwVw4vqX57J8gahRLcgnGJ5sCHf0pNjwwr7JUs/M9p+VN2UMFA17HKAmkDveu1HYGzANfE7QJMNBS0SLq+S6hTsNe3/Nk5uDBVEpKfmcWFm9gV/RbD2wTKT71wVHLYD0umrLntrsbWpX+/03Afl9qE+XVHwWTbOXcKN9jedHu3A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=9bnE27vAE+PeH4rSPiX5POfJpZ3RRkeeu7vV/J/5jz4=;
b=iBOWv8XEb7y3NwbCnsVh9fmOlb0SVoSRox6sDbI3Cyd9skdmQN5TRUaal5AVnurzC4n7GDxn705k7Kl2YVneDtkma9e1IeiylfcUH8DwZ+F0XCux7TxjcVNqOsATxFwkGLi9p5ou7JhKyl7efF8H14/eK6mM/jxmJ/6oMDW6dUQD0zyjVA+QuOCHPJsV2FL6VCT4TglaTfc7BtMDtxdNz77Gkvw4w550nCpSFr/fs3jm8XQAio0ZfuAJEI3OVXDZtQao9hZYVat8Tgrtz81PUxU9Lun3mqL6ZqoA1HUen4Wicci0MS0oIqVFaP9cXyGUij/u6SohsESo5IVIcVl8AQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=9bnE27vAE+PeH4rSPiX5POfJpZ3RRkeeu7vV/J/5jz4=;
b=RGjQh+d1VPe35v6we6jgoFDM0sdaUadPdgUoSMhF735MwWYMjWI4h/Te/mLtkiCOt7axMSj3/VcRZqVTF9hLBd97pd5MpjtY8iDbyma1okTDbWn1k+CdGCDqhiBH5FwIzhcDsKV+ETyzSgPJAL/kFyTZUKco5QW00dLK/hfCPeE=
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; mit.edu; dkim=none (message not signed)
header.d=none; mit.edu;
dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu;
In-Reply-To: <7dedcb59-f09e-54ed-a0ce-5b5aac3357d@prime.gushi.org>
Content-Language: en-US
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 0105a910-1579-4448-c79d-08d986917248
X-MS-TrafficTypeDiagnostic: BN3PR01MB2196:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <BN3PR01MB2196BA5103E5DC7FCCFFCBC1BCAD9@BN3PR01MB2196.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:4941;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: KHbZSilocwFuQ5CnZ8Ib8I2WxZHT8pd0Rt7MiJ5n0LkgY41pddgsRJkqInUREpYXM8mdK4IzWcEC3ocotZ9KZcFdK/CNhtcWjKDvILae07oSBr4iCdYQVGYYfP+FfKtdzFc7A2aWIqdYRkAt3D08wgz00zU/LQuTKZr9RVzsjNjSSfR5m++28/a4DPZZnKtMiZg8DwVxfzRSPusx+mRtA+uwyPFL1ELh1Yxp6oTS7wAa2Ek1iLhgwB4JQsYd5fh2n+b9pBrhCwKQX+IqsUrr0W5b+YpC7YF6AY8CK2JG8owNImz6bM61fcygLVnzsBli5xE2N2+nVXvfh6z/E3Wk/2hrU268zU1HPCPxHgiFZ/Ouoh67b4BZ6OfLr+Y5hKnYDEcd8ZXJ7CWM92xYRjMi42ZtnJbci3C2W9YwJ8EQooK8X8ZjhGOINKxIdNPFU15d6TXBW9enAWldrLIJ7p8neBHcXYiFtgibGt3E68W4vyYnCQoy4vjy4lt1GK81exxmSuECDL/Em3n3lNboT/wg2hfxJEZjj0hJmDAhIVkod9PfsBCWtOlyeSR3K0tMfnpBqtF7xUsczrJpt7Twvjwq1ihBvnsIj/WABfH14bN6NVUn4u3cDl8GUNvceM/iazq7PRSsOQzZJ4A4bKAl04N4SQTPNT9WJGhMTzEmqsOrneGNvhfdCQlBbKJKK7XX1P5dN4Z//TRUAQWDV4Vfp4wSSA==
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu;
PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(4636009)(2616005)(86362001)(8676002)(316002)(26005)(4744005)(786003)(356005)(5660300002)(956004)(31686004)(75432002)(36756003)(2906002)(336012)(6636002)(70586007)(426003)(53546011)(31696002)(6706004)(508600001)(7696005)(68406010)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2021 17:15:49.2989 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 0105a910-1579-4448-c79d-08d986917248
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT032.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR01MB2196
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Greg Hudson - Sun, 3 Oct 2021 17:15 UTC

On 10/3/21 3:36 AM, Dan Mahoney (Gushi) wrote:
> We're in the process of rolling our mkey to get off 3des, and we found
> that someone in the before-times has put this line in our kdc.conf:
>
> master_key_type = des3-hmac-sha1
[...]
> Would things break if I just took this line out? Or would the kdc fail to
> start because a K/M of the default enctype isn't present yet?

>From a review of the code, I am pretty sure that this setting is only
used when the mkey is entered from the keyboard (including during KDB
creation). Assuming you are using a stash file, you should be able to
remove this setting.

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor