Subject: [Ietf-krb-wg] FAST: Security of replacing reply key

From: [email-masked]
Date: Mon, 30 Mar 2009 13:00:18 -0400 (EDT)

FAST allows the reply key to be replaced in a KrbFastResponse message.
The encrypted challenge factor makes use of this facility, after
verifying the requestor's knowledge of the client long-term key.

If a ticket-based armor is used to protect the exchange--say, using
the host key of the client machine--then anyone with knowledge of the
long-term key of the armor ticket can observe and decrypt the
exchange, read the reply key in the KrbFastResponse message, and
decrypt the returned credentials without knowledge of the user's
long-term key.  In many cases knowing the armor ticket long-term key
is synonymous with being root on the client's host, which would grant
access to the decrypted credentials anyway, but at a minimum this
relationship should be made clear in the security considerations.

If an anonymous pkinit ticket is used to armor the exchange, then I
think a man in the middle might be able to read the user's credentials
in the AS reply without knowledge of the client's long term key.  I
haven't thought this case through in detail, and
https://lists.anl.gov/pipermail/ietf-krb-wg/2009-January/007271.html
suggests that it might not be possible for a man in the middle to make
encrypted challenge succeed while still being able to read the armored
parts of the exchange (except through a dictionary attack on the
client long-term key).

Conceivably FAST could be changed so that KrbFastResponse includes a
strengthening key, rather than a replacement key.  In this case, a
third party with knowledge of the armor ticket long-term key would
still be in a position to perform a dictionary attack against the
user's password using the AS response--but such a third party can
already do so using the messages encrypted in the challenge key.

(Also, why is the rep-key field of KrbFastResponse not part of the
finished structure?)
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg