[krbdev.mit.edu #6116] kadm5_decrypt_key sets bad encryption type

[The RT System itself via RT]

>From krb5-bugs-incoming-bounces at PCH.MIT.EDU  Fri Sep 12 12:14:08 2008
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP
	id m8CGE8o4011375; Fri, 12 Sep 2008 12:14:08 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m8CGE3TN026764;
	Fri, 12 Sep 2008 12:14:03 -0400
Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU
	[18.7.7.76])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id m8CFhmOg019953
	for <krb5-bugs-incoming at PCH.mit.edu>; Fri, 12 Sep 2008 11:43:48 -0400
Received: from mit.edu (M24-004-BARRACUDA-3.MIT.EDU [18.7.7.114])
	by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id
	m8CFhboo002961
	for <krb5-bugs at mit.edu>; Fri, 12 Sep 2008 11:43:37 -0400 (EDT)
Received: from spam.ifs.umich.edu (spam.ifs.umich.edu [141.211.1.36])
	(using TLSv1 with cipher AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mit.edu (Spam Firewall) with ESMTP id CFD4110A8AB8
	for <krb5-bugs at mit.edu>; Fri, 12 Sep 2008 11:43:16 -0400 (EDT)
Received: from root by spam.ifs.umich.edu with local (Exim 4.69)
	(envelope-from <mdw at umich.edu>)
	id 1KeAnj-0005gH-R8; Fri, 12 Sep 2008 11:43:15 -0400
To: krb5-bugs at mit.edu
Subject: kadm5_decrypt_key can return invalid encryption type
From: mdw at umich.edu
X-send-pr-version: 3.99
Message-Id: <E1KeAnj-0005gH-R8 at spam.ifs.umich.edu>
Date: Fri, 12 Sep 2008 11:43:15 -0400
X-Spam-Score: 0.55
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Fri, 12 Sep 2008 12:14:01 -0400
Cc: kwc at umich.edu, vpliakas at umich.edu, mdw at umich.edu
X-BeenThere: krb5-bugs-incoming at mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: mdw at umich.edu
Sender: krb5-bugs-incoming-bounces at PCH.MIT.EDU
Errors-To: krb5-bugs-incoming-bounces at PCH.MIT.EDU

>Submitter-Id:	net
>Originator:	 mdw at umich.edu
>Organization:
	University of Michigan
>Confidential:	no
>Synopsis:	kadm5_decrypt_key sets bad encryption type
>Severity:	non-critical
>Priority:	low
>Category:	krb5-admin
>Class:		sw-bug
>Release:	1.6.3
>Environment:
	dell pe1750 running umce linux, krb5 1.6.3+patches
System: Linux strawdogs.ifs.umich.edu 2.6.23.1 #3 SMP Tue Oct 23 11:37:43 EDT 2007 i686 GNU/Linux

Architecture: i686

>Description:
	kadm5_decrypt_key has a bug which causes it to return an
	encryption type of -1 sometimes.  This affects
	fakeka and krb524d, depending on the choice of encryption
	and salt types.
>How-To-Repeat:
	Write a program which calls kadm5_decrypt_key handing it an
	encryption key of -1, then look at the encryption key type
	returned, or try to use the key.
>Fix:
	Run-time workaround, don't use kerberos 4.  If using kerberos 4
	and fakeka/krb524d, be careful about salts and encryption types
	used.  Beware when calling kadm5_decrypt_key in any site specific
	code, not to use a wildcard encryption type.  Compile-time fix, apply
	the patch in
	/afs/umich.edu/group/itd/build/mdw/krb5.15x/patches/krb5-1.6.3-kbetype.patch