Subject: Re: ["Frank O'Dwyer" <[email-masked]>: Re: Kerberos login sniffer and cracker for Windows 2000/XP]

From: Jeffrey Altman <[email-masked]>
Date: Mon, 2 Dec 2002 11:21:23 EST

> > I was under the impression that the TLS Kerberos cipher suite was an
> > AP_REQ/AP_REP exchange.  How do you generate an AP_REQ without talking
> > to the KDC first?  (chicken and egg problem)
> 
> Using a different principal's key.

Whose principal's key other than my own am I going to have access to?

> It's the same as the DCE RFC26 solution, only instead of doing it in the
> pre-auth holes you do it with TLS.

 Jeffrey Altman * Volunteer Developer      Kermit 95 2.1 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 2 Dec 2002 08:37:21 -0800

> Whose principal's key other than my own am I going to have access to?

We're going in circles Jeff.  My point stands: specifying a solution
akin to DCE RFC 26 will gain us much and lose us nothing, so let's do
it, and while we're at it let's also solve the generic case so your
kiosk case can be handled too.  I do not believe that the KRB WG can do
the latter quickly enough and in a way that is cheap enough to implement
that it would get implemented quickly by the various vendors - otherwise
I would not bother with the DCE RFC 26 approach, so let's get on with it
and specify a solution based on DCE RFC 26 please.

Cheers,

Nico