Subject: [Ietf-krb-wg] Question about cryptographic protection of message fields

From: Fernando Pereñíguez Garcia <[email-masked]>
Date: Mon, 15 Feb 2010 18:20:43 +0100

Hi all,
   Looking for into the Kerberos specification and the MIT implementation, I've found that not all the fields defined in the Kerberos messages are cryptographically protected. For example, in the KDC-REQ/KDC-REP, the padata field is sent in clear and (at least) is not integrity protected. Therefore, an attacker can change the information contained in any of these fields and the client is not able to detect this attack. For this reason, I was wondering if my conclusions are right. 

  Thanks in advance,
   Fernando.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg