1

Kerberos supports different ways (ccache types) of storing tickets, such as:

  • FILE
  • MEMORY
  • KEYRING

I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and service ticket in a YubiKey. These tickets could then be read from the key when they are needed and directly be erased from memory after being sent.

I know that the whole point of storing a private PGP key in a YubiKey is the fact that it can only be written and never be read again. All necessary operations are executed inside the YubiKey.

Kerberos tickets would have to be readable so they can be sent to the Key-distribution-center or web service.

So, would it be possible to use a YubiKey as another ccache type for Kerberos?

Improve this question
4
  • Interesting idea! In a purely theoretical sense it could certainly work, but practically speaking there is no existing capability to do this. Also Windows wouldn't natively understand where it's stored.
    – Steve
    Jun 21 '17 at 23:42
  • Since the tickets are ephemeral by design, it is highly unlikely this could be easily done in any useful manner. I suppose you could write a kerberos based system that would allow this, but the level of effort for the potential benefit would likely be minimal. It's like printing out the binary value of tcp packets, walking over to another computer, and typing that binary back in by hand.
    – 0xSheepdog
    Jun 22 '17 at 13:13
  • @Steve, yes Windows and also Linux wouldn't natively know how to read the ticket from the YubiKey, but you agree that there is no technical limitation from the YubiKey's side, right?
    – arne.z
    Jun 22 '17 at 20:14
  • The problems you'll run into with the yubikey side of things are this: 1) writing to the yubikey, 2a) reading the same key back out so the system can use it, 2b) using the key to sign/encrypt without it leaving the token, 3) reading/writing is going to be slooooow. So you're good if you can deal with those things, however @0xSheepdog is right: in this particular case the value isn't necessarily there. That said, have you considered smart cards or the YubiHSM? They're intended to do 1 and 2b.
    – Steve
    Jun 26 '17 at 14:07
1

Agreeing with @84104, storing the credential cache on the YubiKey doesn't make a lot of sense; you would be better off using a FILE: cache on a regular USB drive. Kerberos requires access to the tickets in the cache, and if you delete your tickets from memory, programs that need tickets will either re-prompt for tickets, or break.

Have you considered the simpler way to use a YubiKey? You can store your Kerberos password on the YubiKey as a static password.

Improve this answer
1

This is a weird/bad idea.

You'd likely better off somehow integrating the YubiKey with RFC4556 aka pkinit.

Abstract
This document describes protocol extensions (hereafter called PKINIT) to the Kerberos protocol specification. These extensions provide a method for integrating public key cryptography into the initial authentication exchange, by using asymmetric-key signature and/or encryption algorithms in pre-authentication data fields.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.