Subject: RE: "key type not supported" and XP SP2 changes ?

From: "Tim Alsop" <[email-masked]>
Date: Tue, 7 Sep 2004 15:37:53 +0100

Hi,
 
After further investigation the reason for this problem has been
identified. It is occuring because of AllowTgtSessionKey not being a
valid registry setting in XP SP1. Basically the Kerberos library does
not recognise RC4 session keys so it gives an error, but if
AllowTGTSessionKey is 0 (default on SP2) it does not see a session key
that it doesn't recognise. 
 
The customer that this problem relates to is not planning to install SP2
for about 9 months so we need to see if there is a way to implement the
AllowTGTSessionKey as a hotfix to SP1 instead of installing SP2. Does
anybody know if there is such a fix available ?
 
Thanks, Tim.

________________________________

From: [email-masked]
[mailto:[email-masked]] On Behalf Of Tim Alsop
Sent: 07 September 2004 12:28
To: [email-masked]
Subject: "key type not supported" and XP SP2 changes ?

Hi,
We are using a gss-api library that only supports DES and 3DES - when we
initiate a security context using an RC4 tgt issued during MS GINA logon
we can obtain a service ticket (using DES-MD5) from AD KDC, but only if
Windows XP SP2 is installed. If we remove SP2 and go back to SP1 we get
"key type not supported". We are therefore trying to find out what
changes were made in SP2 that might cause this to occur ? Does anybody
have any ideas ?
Thanks, Tim

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 07 Sep 2004 11:12:20 -0400

I am confused about two things:

(1) why is this discussion taking place on an IETF mailing list?
     an appropriate place for this discussion would be [email-masked]
     or one of the Microsoft specific security newsgroups

(2) AllowTGTSessionKey applies to Windows 2003 and XP SP2 (and may
     apply to a future 2000 service pack).  In all other versions of
     Windows, the TGT session key will always be exported upon request.
     Therefore, if you have an RC4 session key in the TGT, then it will
     be exported by default on pre-XP SP2 systems but not in XP SP2.
     Your problem description therefore seems reversed.

I suggest you post this query to [email-masked] and include a
description of what your MSGINA does to obtain a TGT.

Jeffrey Altman

Tim Alsop wrote:

> ------------------------------------------------------------------------
> *From:* [email-masked] 
> [mailto:[email-masked]] *On Behalf Of *Tim Alsop
> *Sent:* 07 September 2004 12:28
> *To:* [email-masked]
> *Subject:* "key type not supported" and XP SP2 changes ?
> 
> Hi,

---

From: Martin Rex <[email-masked]>
Date: Tue, 7 Sep 2004 17:54:25 +0200 (MET DST)

>      or one of the Microsoft specific security newsgroups

Why not?

Although it may not be directly related to any of the krb-wg milestones
on the charter, it is some kind of interoperability issue for an
installed base of Kerberos code.  Interoperbility issues of new
development(s) with installed base is still within scope of the krb-wg.

Personally I'm not subscribed to any other Kerberos or Microsoft mailing
lists and I'm not a Kerberos implementor myself, but I regularly have
to deal with customer problems related to (Microsoft) Kerberos updates
that break interoperability one way or another, and therefore I'm glad
to hear about problems from implementors/vendors before I'm faced
with high-priority customer problems.  *We* don't use Kerberos ourselves
(except where it is used by Microsoft between NT boxes of a W2K domain).

We have (ab)used this list before for discussing Kerberos interoperability
issues of this kind, and the last time when the chair intervened it was
because we generated to much traffic about the details of a single issue,
not because it was discussed (at least that was how I understood the
notification from the wg chair).

-Martin

---

From: Sam Hartman <[email-masked]>
Date: Tue, 07 Sep 2004 16:27:59 -0400

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    Martin> Why not?

    Martin> Although it may not be directly related to any of the
    Martin> krb-wg milestones on the charter, it is some kind of
    Martin> interoperability issue for an installed base of Kerberos
    Martin> code.  Interoperbility issues of new development(s) with
    Martin> installed base is still within scope of the krb-wg.

It sounds like an API issue contained singly within one
implementation.  There seem to be no implications for the bits going
over the wire.

This seems entirely out of scope for the IETF.

---

From: Martin Rex <[email-masked]>
Date: Wed, 8 Sep 2004 00:54:08 +0200 (MET DST)

> This seems entirely out of scope for the IETF.
 
I disagree.

GSS-API is an API and clearly within IETF scope, as well as
GSS-API extensions, even when they're not really portable--or actually
mechanism specific (just look at the proposed kitten work items...)

-Martin

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 07 Sep 2004 19:31:59 -0400

>> This seems entirely out of scope for the IETF.

I don't.  Tim's problem relates to the interaction between his Kerberos 
library (i.e. part of his product) and Kerberos-related interfaces provided 
by Windows.  The fact that he mentioned that code he's working on happens 
to be his GSS implementation does not make this a GSS-API issue.

The API's provided by Kerberos implementations are not standardized.  They 
are not currently within the scope of this working group or of any other 
IETF working group.

Except for issues related specifically to the Kerberos mechanism, the 
GSS-API is _also_ not within the scope of this working group.  It may be 
within the scope of the KITTEN working group; the mailing list for that 
group is [email-masked].

The number of messages in this thread related to whether this is the right 
forum now outnumber the number of messages related to the original 
question.  The discussion of the original question has been taken to the 
[email-masked] mailing list; in the meantime, we are left with this 
meta-discussion, which is certainly not within the scope of this working 
group.

Further technical discussion on this topic to [email-masked].
Further is-this-the-forum meta-discussion to /dev/null.

-- Jeff

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 07 Sep 2004 20:11:04 -0500

> mechanism specific (just look at the proposed kitten work items...)

I agree with Sam and Jeff that the original discussion is outside the WG.
The problem is internal to Windows, and not the Kerberos protocol,
and any API covered by any if the WG docs.

-- 

  Douglas E. Engert  <[email-masked]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444