Problem - Kevin Tafuro

API for encryption and decryption, although the number of supported ciphers is considerably
fewer than those provided by other cryptographic protocols. Authentication
yields a cryptographically strong session key that can be used as a key for
encryption.
This recipe works on Unix and Windows with the Heimdal and MIT Kerberos
implementations. The code presented here will not work on Windows systems that
are Kerberos-enabled with the built-in Windows support, because Windows does
not expose the Kerberos API in such a way that the code could be made to work. In
particular, the encryption and decryption functions used in this recipe are not
present on Windows unless you are using either Heimdal or MIT Kerberos. Instead,
you should use CryptoAPI on Windows (see Recipe 5.25).
Discussion
Kerberos provides authentication between clients and servers, communicating over
an established data connection. The Kerberos API provides no support for establishing,
terminating, or passing arbitrary data over a data connection, whether pipes,
sockets, or otherwise. Once its job has been successfully performed, a cryptographically
strong session key that can be used as a key for encryption is “left behind.”
We present a discussion of how to authenticate using Kerberos in Recipe 8.13. In
this recipe, we pick up at the point where Kerberos authentication has completed
successfully. At this point, you’ll be left with at least a krb5_context object and a
krb5_auth_context object. Using these two objects, you can obtain a krb5_keyblock
object that contains the session key by calling krb5_auth_con_getremotesubkey( ).
The prototype for this function is as follows:
krb5_error_code krb5_auth_con_getremotesubkey(krb5_context context,
krb5_auth_context auth_context,
krb5_keyblock **key_block);
Once you have the session key, you can use it for encryption and decryption.
Kerberos supports only a limited number of symmetric ciphers, which may vary
depending on the version of Kerberos that you are using. For maximum portability,
you are limited primarily to DES and 3-key Triple-DES in CBC mode. The key
returned from krb_auth_con_getremotesubkey( ) will have an algorithm already associated
with it, so you don’t even have to choose. As part of the authentication process,
the client and server will negotiate the strongest cipher that both are capable of
supporting, which will (we hope) be Triple-DES (or something stronger) instead of
DES, which is actually rather weak. In fact, if DES is negotiated, you may want to
consider refusing to proceed.
Many different implementations of Kerberos exist today. The most prominent among
the free implementations is the MIT implementation, which is distributed with Darwin
and many Linux distributions. Another popular implementation is the Heimdal
implementation, which is distributed with FreeBSD and OpenBSD. Unfortunately,
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Using Kerberos Encryption | 471