Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556.

From my understanding of how Kerberos works, it doesn't actually send the password. So I'm wondering: How does public keys add to the security of Kerberos? Is it something I should be using?

As a side note: We have some Mac users in our office, and unfortunately pkinit is missing. I haven't been able to find much about why this is, other than this post on the Apple mailing list saying "we highly recommend against using this for any purpose". Is this because of the security of RFC4556, or the security of how the platform used that protocol?

share|improve this question
    
As far as I remember, there was a semi-practical attack on Kerberos crypto, when symmetric encryption is used. –  Vitaly Osipov Oct 10 '12 at 7:43

1 Answer 1

From RFC4556 :

In the AS exchange, the KDC reply contains the ticket session key, among other items, that is encrypted using a key (the AS reply key) shared between the client and the KDC. The AS reply key is typically derived from the client's password for human users. Therefore, for human users, the attack resistance strength of the Kerberos protocol is no stronger than the strength of their passwords.

Therefore PKI extension is supposed to improve security of this initial Authentication Service exchange.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.