Subject: Re: [Ietf-krb-wg] KrbFastArmoredReq.req-checksum

From: Sam Hartman <[email-masked]>
Date: Tue, 14 Apr 2009 08:20:48 -0400

>>>>> "Srinivas" == Srinivas Cheruku <[email-masked]> writes:

    Srinivas> Sam, The req-checksum field in KrbFastArmoredReq is used
    Srinivas> to tie the armored request with the outer request. Is
    Srinivas> this correct? If not, why req_checksum is needed?

We're not entirely sure that req_checksum is needed.  However we
believed that tieing the inner request to an outer request is a good
idea.

    Srinivas> Is req-checksum better be placed in KrbFastReq instead
    Srinivas> of KrbFastArmoredReq as KrbFastReq is encrypted with the
    Srinivas> armor key, so that it is not easy for a eaves-dropper to
    Srinivas> know and alter the checksum?

The KDC MUST confirm that the req_checksum is a keyed checksum.
That's sufficient to make sure that it is not modified.

This is a good catch though: the draft does not mention that
requirement.
Thanks again for your comments.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Srinivas Cheruku <[email-masked]>
Date: Tue, 14 Apr 2009 11:00:26 +0100

Sam,

The req-checksum field in KrbFastArmoredReq is used to tie the armored request with the outer request. Is this correct? If not, why req_checksum is needed?

Is req-checksum better be placed in KrbFastReq instead of KrbFastArmoredReq as KrbFastReq is encrypted with the armor key, so that it is not easy for a eaves-dropper to know and alter the checksum?

Thanks,
Srini