encryption and decryption help

[Sam Hartman]

>>>>> "CD000" == CD000 Albert Shen <zyshen at fameg.com> writes:

    CD000> hi, all: I program a simple client on the embedded
    CD000> system. I use the des-cbc-md5 and des-cbc-crc as the
    CD000> prefered encryption and checksum algorithm. But I find the
    CD000> iv for md5 mode is just 8 bytes 0 and the iv for crc is the
    CD000> same as the key. So I am confused bucause the ivs for these
    CD000> two modes are all 0 according to RFC1510. Is the rfc has
    CD000> been changed or MIT kdc makes a change.

The RFC is wrong.  We've actually been in the process of revising the
RFC for several years and are mostly done.  The new encryption
specification has already been approved for publication.  You should
go to the Kerberos working group page at http://www.ietf.org/ and read
two drafts: the encryption specification and the kerberos
clarification draft.  I think you'll find these answer your questions.

But yes, the IV for des-cbc-crc is in fact the key.

    CD000>      Another problem is when I derive an initial key from
    CD000> user's password, I found MIT release just use the password
    CD000> instead of password plus principal name and realm according
    CD000> to the rfc. 

This is misleading.  MIT supports several possible salt
configurations.  The v4 salt type will use an empty salt.  The normal
salt type will use the RFC 1510 salt.  You can set this configuration
in the kdc.conf file on the kdc.  It takes effect after a password
change.  The clarifications draft describes how a client knows which
salt to use.

Good luck.

--Sam