Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: Kerberos protocol transition with unconstrained delegation (i.e.
TGT impersonation)
Date: Fri, 28 Oct 2022 00:06:50 -0400
Organization: TNet Consulting
Lines: 10
Message-ID: <mailman.119.1666930024.8148.kerberos@mit.edu>
References: <BYAPR12MB2888DAD8E37405BF96B1065CBB339@BYAPR12MB2888.namprd12.prod.outlook.com>
<87y1t1ntsv.fsf@hope.eyrie.org>
<CALF+FNxW4gXTuS6iBPKaFeLLRoD1Y+-n-Nd-G7-V=W30AOg9eg@mail.gmail.com>
<3c20a908-eced-131e-527d-5b7fab957a68@mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="3757"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Thunderbird/102.2.2
Cc: Jonathan Calmels via Kerberos <kerberos@mit.edu>,
Jonathan Calmels <jcalmels@nvidia.com>
To: Jeffrey Hutzelman <jhutz@cmu.edu>, Russ Allbery <eagle@eyrie.org>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=fLJDwu09JEI7/qKwmw90A+2jmH3Lu3TIQlt+PImFAWw8nuYCdJNpeWIVHNMwSJMpY+VaYj363V+YHOoLIB94tlIa6RvSsFqqplmVsYo1DUFDrtX55GsnRX8VYFiu52Gf24zAvfOmzTQf8YoH3PglgNyayKdo5W1LfPX5p+i1fMJaS5VslYyNV9IQqGxoElFOWQEWeby7f/CZT8E5NNRc/RlM8uAZO/+irI55aaH/lBkCaLKX5Uu2r3froxMP7LO2PfpOtAXZCdb8gool7QG8V/rlqN0JDbob2CTmWr4xphFcyimb5zR3ODqg9G+b0bCc04m0g5rTln2lozB8pD0drw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=GnDv0MG8SqXYtwagj64Fih0R6aN6a23kidrAsl1VbrA=;
b=Pqjnmg8jSxy5RQCXVP0rMBFwKMhg81So0UJ3DPeSTdamjgzz9GRgSlYA0mFmJjHOQiAB+h8vD16WaH5ovfboZIHNw8HGWEh3qOJAoKAXrFnKEZTZrtHKjzz+KWCPeVi01HsbvCkJW/ySxnJ+273LaVlOySHxQP1+lnYhq5kqFpBTYVvADDa9Uswwy+MYkiRRBLy0unc5Jf405E3kRG2EOMfj/9glbZlyPZxb3U3a6kNbC/U3Xp/VTi2tjg7XHu4JiEgzS5eOC37Gm+1qsxOD50M+rG650zv1Q+7K/x9o1Ypy1pj9Ke8bsW22HfDeHsXWtagT++1q6M7pHDlpOrylRQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
18.9.28.11) smtp.rcpttodomain=mit.edu smtp.mailfrom=mit.edu; dmarc=pass
(p=none sp=none pct=100) action=none header.from=mit.edu; dkim=pass
(signature was verified) header.d=mit.edu; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=GnDv0MG8SqXYtwagj64Fih0R6aN6a23kidrAsl1VbrA=;
b=HxKv70fo7Ey/GMjEcu+hITezIzwsTocWI3+o7FqO/pXU9q0wlCVGqlETp8CMd0KVMNjvrIl/Bane2I4UGjbuduWTmxXf7K4UL6uHzoA1zT6/CIu9HRK0DBef8ShN5akELICNoK9qrhzmieTV20VP0HQaB/jJhLJiyb4cRVgdgXs=
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; dkim=pass (signature was verified)
header.d=mit.edu;dmarc=pass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=outgoing;
t=1666930013; bh=GnDv0MG8SqXYtwagj64Fih0R6aN6a23kidrAsl1VbrA=;
h=Date:Subject:To:Cc:References:From:In-Reply-To;
b=qOgn/qF3svXYJtbbtgciwjYzhpr9V4kiSbbA3Nr1JdHz/NWYwGgKOWUNlblAyPeTF
SY8/CpnO40rIEwPcnwBuqBpSblkYTrqCI4+FXkPeiGtmzqHJlkj4C/ku6JAPd+dGgJ
BLkuagU9zl5tm9pZpQ91og0/7atiPH3xoswNV4GqgG701LwgRj9HNTB3E+zohbVU0v
e5kbUpjZ9FkeV7uivI6JKdtUo0jH+V8gXVZoHk7MVG3mfmH4b7xBHzmMD7QIITVjfP
bHYFEeW7Msae9VqBF2n+nM0yIPetPnjSnr/e4dbHeIYrMntUmvA45fciEHxQFvAPPB
UoNly7GdsRw6A==
Content-Language: en-US
In-Reply-To: <CALF+FNxW4gXTuS6iBPKaFeLLRoD1Y+-n-Nd-G7-V=W30AOg9eg@mail.gmail.com>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DM6NAM11FT014:EE_|MWHPR0101MB3038:EE_
X-MS-Office365-Filtering-Correlation-Id: 7a1096d0-1f2b-4f0a-28c4-08dab899dc12
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: KSXoiUwchT1cElMbOwE9/CB2xs/3XhGX1nIlCqF0CEzSLJ7Nad7ON9yXWvR/IpNnEwl90T0uEK+k3+Dmh8tkva7tebAW+wMlR7W6e/YiB7i+XwTc4NKahuWXwKs7jBxKW+Ug66u+A1gNnOzNZp/QWuuBcNX9QdmMXFNSbG0ltz3rprZne6/MVvrcAdRWttFxUNOpB/amYF76/rL4dZZDjk2HlNWAq3IsXqazssFlt3LJo5q2GGWg3hJefg3IAcu3qr/h79fbAzT8fRCUlFIXH2ln3HfmSUDzsT6qFnjWB3sQYzOMDekA4j2ZjFi1tvpdEzNOpvFN4z4QeeY2qf1YhdIHy/GVOtL8cItbJ2SQShgQhBrclAfqs6PjOlOG/DZKDZdbg9PnZVColE+pDw0NCEUMKjHvPTEIhEgUVOdNoZk1JRbLMixxKGfgKWqOVr6rgjdbHjP9dJdxpjT099/mLHmneRIoN7OC23xiKjTzyAy1yK5FoYH9dW251fuC+/t7z9CHWbzurFTyqKCPzAofSTANzdZZPh0ktF3qDwocnRPQ+0n8vm9li2eK3jQh1S4GbtKkjOfyE0zIHro8JmxjR9Rec9uxK4OhUsZ8EjnbgaN7Fmz0KMPobfyIS+wl+xNoWMfy80Pc7RCLhV/ikSN6uPn2rDL9j5/ODTqVry4SpMsHmpZ24A3xz3TPDbK1zP3uqx7/saJBDVMXVk5cjSpJDL0E08WK7QJUWoaPyQTcyhfwsFD0plrA17fCCxgL11WGEJ/nNpq5N+G7Vthy3F/cdpyxNmUNQM+sE9cu2jgID6DMPH5+caJeUkf2OQlJy1RY
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu; PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(13230022)(4636009)(376002)(136003)(396003)(346002)(39860400002)(451199015)(956004)(2616005)(31686004)(356005)(316002)(786003)(54906003)(478600001)(36756003)(86362001)(7696005)(75432002)(31696002)(110136005)(26005)(4326008)(107886003)(426003)(53546011)(83380400001)(336012)(5660300002)(2906002)(4744005)(70586007)(6706004)(8676002)(68406010)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Oct 2022 04:06:58.4437 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 7a1096d0-1f2b-4f0a-28c4-08dab899dc12
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT014.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR0101MB3038
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <3c20a908-eced-131e-527d-5b7fab957a68@mit.edu>
X-Mailman-Original-References: <BYAPR12MB2888DAD8E37405BF96B1065CBB339@BYAPR12MB2888.namprd12.prod.outlook.com>
<87y1t1ntsv.fsf@hope.eyrie.org>
<CALF+FNxW4gXTuS6iBPKaFeLLRoD1Y+-n-Nd-G7-V=W30AOg9eg@mail.gmail.com>