Subject: "key type not supported" and XP SP2 changes ?

From: "Tim Alsop" <[email-masked]>
Date: Tue, 7 Sep 2004 12:28:03 +0100

Hi,
 
We are using a gss-api library that only supports DES and 3DES - when we
initiate a security context using an RC4 tgt issued during MS GINA logon
we can obtain a service ticket (using DES-MD5) from AD KDC, but only if
Windows XP SP2 is installed. If we remove SP2 and go back to SP1 we get
"key type not supported". We are therefore trying to find out what
changes were made in SP2 that might cause this to occur ? Does anybody
have any ideas ?
 
Thanks, Tim

---

From: "Tim Alsop" <[email-masked]>
Date: Tue, 7 Sep 2004 16:48:09 +0100

Jeffrey,

I used ietf list because I wasn't sure which list was most appropriate.
I will post to [email-masked] as you suggested.

Thanks, Tim. 

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]] 
Sent: 07 September 2004 16:12
To: Tim Alsop
Cc: [email-masked]
Subject: Re: "key type not supported" and XP SP2 changes ?

I am confused about two things:

(1) why is this discussion taking place on an IETF mailing list?
     an appropriate place for this discussion would be [email-masked]
     or one of the Microsoft specific security newsgroups

(2) AllowTGTSessionKey applies to Windows 2003 and XP SP2 (and may
     apply to a future 2000 service pack).  In all other versions of
     Windows, the TGT session key will always be exported upon request.
     Therefore, if you have an RC4 session key in the TGT, then it will
     be exported by default on pre-XP SP2 systems but not in XP SP2.
     Your problem description therefore seems reversed.

I suggest you post this query to [email-masked] and include a
description of what your MSGINA does to obtain a TGT.

Jeffrey Altman

Tim Alsop wrote:

> Hi,
>  
> After further investigation the reason for this problem has been 
> identified. It is occuring because of AllowTgtSessionKey not being a 
> valid registry setting in XP SP1. Basically the Kerberos library does 
> not recognise RC4 session keys so it gives an error, but if 
> AllowTGTSessionKey is 0 (default on SP2) it does not see a session key

> that it doesn't recognise.
>  
> The customer that this problem relates to is not planning to install 
> SP2 for about 9 months so we need to see if there is a way to 
> implement the AllowTGTSessionKey as a hotfix to SP1 instead of 
> installing SP2. Does anybody know if there is such a fix available ?
>  
> Thanks, Tim.
> 
> ----------------------------------------------------------------------
> --
> *From:* [email-masked]
> [mailto:[email-masked]] *On Behalf Of *Tim 
> Alsop
> *Sent:* 07 September 2004 12:28
> *To:* [email-masked]
> *Subject:* "key type not supported" and XP SP2 changes ?
> 
> Hi,
> We are using a gss-api library that only supports DES and 3DES - when 
> we initiate a security context using an RC4 tgt issued during MS GINA 
> logon we can obtain a service ticket (using DES-MD5) from AD KDC, but 
> only if Windows XP SP2 is installed. If we remove SP2 and go back to 
> SP1 we get "key type not supported". We are therefore trying to find 
> out what changes were made in SP2 that might cause this to occur ? 
> Does anybody have any ideas ?
> Thanks, Tim

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 7 Sep 2004 16:49:27 -0700

Martin Rex wrote:
> Sam wrote:
> > This seems entirely out of scope for the IETF.
> I disagree.

When you find an issue with respect to a particular implementation, you
should first contact the vendor and get the issue confirmed, and perhaps
addressed.

I can see the following drawbacks sending preliminary findings to this
IETF DL: 
1) A report can be inaccurate and misleading, if it is not confirmed by
the vender in question; misinformation usually distracts the attention
of the working group.
2) The majority of the subscribers of this DL are not at a position to
comment on the issue reported authoritatively

As for the specific problem in this thread, the issue is that we will
zero out the enctype field in this API if the caller does not have the
necessary permission to retrieve the session key. Instead, we should
just return the enctype field, because the enctype information is easily
discoverable. 

This issue is fixed in Longhorn, you can request a QFE if you honestly
believe you need the fix. Of course, Jeff has pointed out in a separate
email the registry key trick that can give you permission to retrieve
the session key (and the enctype field).

Thanks,

Larry
-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Martin Rex
Sent: Tuesday, September 07, 2004 3:54 PM
To: Sam Hartman
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: "key type not supported" and XP SP2 changes ?

Sam Hartman wrote:
> 
> It sounds like an API issue contained singly within one 
> implementation.  There seem to be no implications for the bits going 
> over the wire.
> 
> This seems entirely out of scope for the IETF.
 
I disagree.

GSS-API is an API and clearly within IETF scope, as well as GSS-API
extensions, even when they're not really portable--or actually mechanism
specific (just look at the proposed kitten work items...)

-Martin

---

From: "Tim Alsop" <[email-masked]>
Date: Wed, 8 Sep 2004 08:10:12 +0100

Larry,

In this case we (the vendor) have confirmed the problem and wanted to
get some feedback from the Kerberos/Microsoft community on this issue.

Reagrding the fix you mentioned - is this available for XP SP1 ? We know
we can install SP2 and we get the fix, but we (actually, one of our
customers) want to implement it in SP1 without installing the entire
SP2. 

Thanks, Tim.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of
Liqiang(Larry) Zhu
Sent: 08 September 2004 00:49
To: [email-masked]; Sam Hartman
Cc: [email-masked]; Tim Alsop; [email-masked]
Subject: RE: "key type not supported" and XP SP2 changes ?

Thanks,

Larry
-----Original Message-----

I disagree.

-Martin