Subject: Protecting AS_REQ (Was: Setting to KRB-WG agenda for IETF 53)

From: "Paul Leach" <[email-masked]>
Date: Mon, 18 Mar 2002 04:03:48 -0800

> -----Original Message-----
> From: Lawrence Greenfield [mailto:[email-masked]] 
> Sent: Tuesday, March 12, 2002 19:24
> 
> There's the identical problem when adding a Windows 2000 
> machine to a domain; I wonder how they secure the host key.

The host key is distributed to the workstation encrypted with a key
derived from the password of the user who is adding the machine to the
domain.

It's still weak, but it's a one time weakness. In corporate
environments, machine setup is sometimes done in controlled network
environments, so it possible to mitigate the onetime problem in a way
that's not possible for every AS_REQ. Also, we hope that the people who
join computers to domains might have stronger passwords that ordinary
users. (Obviously not the case when policy is set to allow oridinary
users to join machines.)

Paul