Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (nike.apache.org: domain of elecharny@gmail.com designates
 74.125.82.48 as permitted sender)
Message-ID: <51649B73.4090104@gmail.com>
Date: Wed, 10 Apr 2013 00:51:31 +0200
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7;
 rv:17.0) Gecko/20130328 Thunderbird/17.0.5
MIME-Version: 1.0
To: Apache Directory Developers List <dev@directory.apache.org>
Subject: Re: kinit failed on - Integrity check on decrypted field failed
References: 
 <7D664BE6CF058A4CB1A06984A7AA678F180012B0B4@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012B182@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <516257D2.4000703@gmail.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012B37F@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <CABzFU-dPsMKOF+egqn0fz_ehgtnAcy5yLiKa=TTO38sGgrT+3A@mail.gmail.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012B435@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <51630065.3010801@gmail.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012B4B8@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012B8F0@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <51639AFA.4030906@gmail.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012BC34@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <516442E4.2040806@gmail.com>
 <7D664BE6CF058A4CB1A06984A7AA678F180012BCA4@SM-CALA-VXMB06A.swna.wdpr.disney.com>
 <7D664BE6CF058A4CB1A06984A7AA678F18003661B1@SM-CALA-VXMB06A.swna.wdpr.disney.com>
In-Reply-To: 
 <7D664BE6CF058A4CB1A06984A7AA678F18003661B1@SM-CALA-VXMB06A.swna.wdpr.disney.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le 4/9/13 11:13 PM, Wu, James C. a écrit :
> Hi,
>
> I came across this page which describes how Kerberos key are derived from the passwords of an entry. 
> http://directory.apache.org/apacheds/kerberos-ug/1.1.3-keys.html
>
> It mentioned that the Kerberos keys are basically a hashed value of the passwords with the salt be the realm name. I am wondering how does the kinit program know the salt for the Kerberos key? Is it passed from apacheds? I did not see something like that mentioned in the log output.
Kinit will not create the hashed values of the password. It's coputed on
the fly when the password is added, on the server. The salt is not used
by kinit.
>
> I guess the kinit has to know both the encryption type and the salt in order to reproduce the Kerberos encryption key so that it can decrypt message from apacheds. Am I right?
No, it's not what happens. The encryption key is negociated by the
server and the client during the very first steps of the kerberos
exchange. In your case, the AES 256 algorithm is being selected.

I'm sorry, I'm in the middle of a release atm, but I'll try to test the
full kinit sequence asap (ie, probably tomorrow my time)

-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com