Will Fiveash's Solaris Stuff

Everything You Wanted to Know About Kerberos Enctypes But ...

Thursday Jun 16, 2005


I wrote a presentation about Kerberos encryption types (enctypes) and how they are used in Kerberos. It is aimed at both developers and administrators. You can download the PDF version here . Note, earlier versions of the presentation had a Sun Confidential label on the bottom of the slides which was left there by mistake. I have removed this label in the latest version of the presentation. I've updated the presentation slightly as of Oct 8,2007.

Technorati Tag: Technorati Tag:

[3] Comments
Like this post? del.icio.us | furl | slashdot | technorati | digg
Posted at 12:35PM Jun 16, 2005 by wfiveash in General
Tags:
Comments:

A very nice document, but I think that where you say "The KDC uses the first server KDB key and enctype to encrypt the server ticket." that is not precisely correct. I believe that the KDC finds the highest key version number in use for that principal, and then takes the first key with that kvno. Often all keys have the same kvno, so this point is moot, but if you use the "-keepold" flag when changing the key you can have multiple kvno's in use.

Also, you don't explicitly say it, but what determines which of the keys is first is the order of the keytypes specified in the KDCs supported_enctypes config at the time the key is created/updated (getprinc in kadmin will list them in order).

Posted by John Hascall on October 04, 2007 at 09:42 PM CDT #

Thanks for that comment John, you are correct and I'll update that document.

Posted by Will Fiveash on October 08, 2007 at 05:48 PM CDT #

JE VEUX QUE VOUS ME PRESENTIEZ KERBBROS

Posted by 41.207.18.40 on November 17, 2008 at 06:24 AM CST #

Post a Comment:
  • HTML Syntax: NOT allowed