4

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556.

From my understanding of how Kerberos works, it doesn't actually send the password. So I'm wondering: How does public keys add to the security of Kerberos? Is it something I should be using?

As a side note: We have some Mac users in our office, and unfortunately pkinit is missing. I haven't been able to find much about why this is, other than this post on the Apple mailing list saying "we highly recommend against using this for any purpose". Is this because of the security of RFC4556, or the security of how the platform used that protocol?

Improve this question
1
  • 1
    As far as I remember, there was a semi-practical attack on Kerberos crypto, when symmetric encryption is used.
    – Vitaly Osipov
    Oct 10, 2012 at 7:43

1 Answer 1

Reset to default
2

From RFC4556 :

In the AS exchange, the KDC reply contains the ticket session key, among other items, that is encrypted using a key (the AS reply key) shared between the client and the KDC. The AS reply key is typically derived from the client's password for human users. Therefore, for human users, the attack resistance strength of the Kerberos protocol is no stronger than the strength of their passwords.

Therefore PKI extension is supposed to improve security of this initial Authentication Service exchange.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.