Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

"I prefer rogues to imbeciles, because they sometimes take a rest." -- Alexandre Dumas (fils)


devel / comp.protocols.kerberos / Re: 2FA with krb5

SubjectAuthor
o Re: 2FA with krb5Greg Hudson

1
Re: 2FA with krb5

<mailman.1.1633707974.11892.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=172&group=comp.protocols.kerberos#172

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: 2FA with krb5
Date: Fri, 8 Oct 2021 11:45:51 -0400
Organization: TNet Consulting
Lines: 19
Message-ID: <mailman.1.1633707974.11892.kerberos@mit.edu>
References: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
<202110070127.1971R4KA032759@hedwig.cmf.nrl.navy.mil>
<87pmsgpt36.fsf@hope.eyrie.org>
<202110071914.197JEXTD007325@hedwig.cmf.nrl.navy.mil>
<380d6720b77f3e741f334afc9fda20bdf75b68f0.camel@redhat.com>
<87h7dspq3b.fsf@hope.eyrie.org>
<09D80C01-53F7-4B2D-95B0-EEE4A9A0F191@prime.gushi.org>
<202110081145.198Bj6o0012853@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="29868"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.11.0
Cc: kerberos@mit.edu
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>, Dan Mahoney <danm@prime.gushi.org>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=AzVAapt96j+5AkK9TGMfR091H2mx3AT+UYK9/whbqj3T+2i2DW1Jy5HnbmDidVAC3oJ4LsNEPSgXifz6Z9bCGTklQKcnUK6k/C5NezVHvpyqLCQls05pGMO2R4bP8Ygk4TbdrCO9OE9olNWzbFIFpO7rLGen92TAi4LHC8OXytxFYzZ4boq/dR///pnc8NlybWsVieksc0F2ZOc73Y8zeB7qrJDQJWaM2u+BUaR1jFoG2nipIhxTIMnAIBQEthMEctX2RF25Lx/fo4TCPO8QQY3Wa6vSqOuImqkGinvfGT66YMcZQbJR13EndrhQP4JdH/FXPhRcteH4+tmanmoPcA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=HEkYN1yPrskZX+KR+vgpp5jRISp1iakSpBboCafBU3s=;
b=b+wBmHa07dCjhucdJx37c9jtolYiY1970Oah9BEPT9PGr5OQ/XRmZH7ZXuusU1rOaZ48DCg3qo2v8IhqzPSLhsl/Hfl/rFBc+MeKWuZ/vEG4GHhhHIreqHBkVyKV8QxRq8vt/i1HZBoEV0HpzCynAV9otugNzFHra8oS39l0LeHMfdScGXQzci8p5Fl5/Q4ffiPQYlqZUTHt8n5tMRV2uSd3LQflvAwO5Q93Xyq91CiUYoH+8pLezNEMU/66RbaNLAGuta/wzJasNm8hmYu06fesEhMQcbzH6dVPuBaXH4HQ7Xg/HhJrtgt4zzvnmmr9zv5z3+WVDFgQhc4Op++8Xg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=HEkYN1yPrskZX+KR+vgpp5jRISp1iakSpBboCafBU3s=;
b=tCEXb/e2vzi92JGjGnKZo27ziaBkPU0OPqKP0r9Kf/dsoWTKB/OVhCnOAwz/3Vimk2XmdAMFskldyHUPCE8gdUWbi8Q/SVQt+JxepFbO+a9smqiaKhRo7vjSgZcm4b/lIjxfT3ip8ntbH9QaRGO8MjZV7sQiYqqjZgbYauMA0yw=
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; mit.edu; dkim=none (message not signed)
header.d=none; mit.edu;
dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu;
In-Reply-To: <202110081145.198Bj6o0012853@hedwig.cmf.nrl.navy.mil>
Content-Language: en-US
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 843051ff-530e-4735-e712-08d98a72b7d9
X-MS-TrafficTypeDiagnostic: SJ0PR01MB6270:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SJ0PR01MB627093C141C8172A016DD29FBCB29@SJ0PR01MB6270.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:3826;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: Nab5trPT/pjFHwLyrivFWENESIFYh8yKXyiNP0SZAxH6YWUVMKY5Bi/I/S9iXiQNK52Yn900cTLP0t/ZMSD/5wWjQ2uz9FITzp8UKjsgGl9XL2yRYhnZqx+HiLAxlIoaC7TxC1r92EcSzUIjsUKH8ZckFAO/GlpJntyRyjMIoU9Qi1q6b51l7Y3Y74oRjwwnDqsctPQgOwtatA8ZfCpkruuzvN01P45y6dPEANoiJVjKdsREbDR15xW0MVY97q3gpD7qKHIwxKYi6O1M5SBgUVoRUvQcfYffkqPfTFG/ApEYt7TsPwhz6cm2MhwssXflHdh6EY8LN1VU5aKFLSIZ1KypTtOxXBftCZE4wBC5yITUb/s+AQi2hI7Z3C0NajzFOfnbSn1N7vFb4ZqQEMAPtcyq99y6DWkSXO6PaS7dOHaYSgeeE0/dLeeeRhK6B91yv4kFIRTR2uVJFKo15c678rNt16rc+PsD5L1hpgSdtbatQomsiUlrM8ALqjbpYyHKem1zFmRdJKI2Q+Lif62Cekg0RwuHGEcqpyekBCrcXELceSszWYHbHt9wEOlU/HvJQ9Q3Yrq8OOor7Xaz/ZR5VHf9w/blMoWNsm6RZs4DryUsYag5cEYks64+T8ile6emjYyqheFNXnurh1meTfeyxCAfMJsuPVLwMHLBO1yrvnxAU+88h/ScrYfArZGMCc1k/IxSK2z80Jxbe0joQdV5Rg==
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu;
PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(4636009)(356005)(31686004)(36756003)(75432002)(4744005)(8676002)(7696005)(4326008)(956004)(53546011)(2616005)(316002)(786003)(31696002)(110136005)(2906002)(86362001)(426003)(508600001)(5660300002)(68406010)(70586007)(26005)(6706004)(83380400001)(336012)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Oct 2021 15:45:56.2023 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 843051ff-530e-4735-e712-08d98a72b7d9
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT046.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR01MB6270
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Greg Hudson - Fri, 8 Oct 2021 15:45 UTC

On 10/8/21 7:45 AM, Ken Hornstein wrote:
>> I mean, this might be dumb, but why not have the kdc able to speak to
>> pam modules directly?

> Kerberos is "I am going to take your password which I already know,
> convert it into an encryption key, and use it to verify your Kerberos
> request". Kerberos needs to know the password/factor to make that
> happen, where the typical 2FA API only tells you "is this token good
> or not?".

I think Dan was assuming one of the cases where the KDC received a 2FA
value and needs an oracle, such as FAST OTP.

One concern is that PAM modules must operate synchronously (unless I'm
badly mistaken), so the KDC process would be blocked if the module has
to talk to a remote server. You can get away with that if your
population of 2FA users is small and the oracle is fast, but OTP oracles
are often deliberately slow to answer. We developed an async kdcpreauth
interface and async RADIUS code to address that problem for FAST OTP.

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor