I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". which he will receive during Kerberos authentication (e.g. during interactive login on his computer). The server-user's KDC session key itself will be obtained by passing the server-user's TGT ticket to the client-user when the standard AP-REQ request to the server is rejected. This request is rejected because the server-user cannot find its "long-term" keys and thus needs to use the session key.

I don't understand why the server user can't find his "long term" keys. Ideally these keys are stored in the LSA, or to be more precise, in the user-server session. Accordingly, the user-server has access to this part of the LSA (because tickets and session keys are also stored there). And if, for example, we perform interactive login to the computer-server by means of a password, then in the user-server session, in addition to tickets, keys in rc4, aes format are also stored. It is these keys, as far as I understand, that are considered "long-term".


You must log in to answer this question.

Browse other questions tagged .