AS_REP question
Markus Moeller
huaraz at moeller.plus.com
Thu Sep 29 17:22:57 EDT 2005
Maybe this helps (from
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/4a1daa3e-b45c-44ea-a0b6-fe8910f92f28.mspx )
Markus
KRB_AS_REP Message Contents
The message includes:
. A TGS session key for the user to use with the TGS, encrypted with
the user key derived from the user's password.
. A TGT for the KDC in tailspintoys.com, encrypted with the TGS key.
The TGT includes:
. A TGS session key for the KDC to use with the user.
. Authorization data for the user.
The authorization data includes:
. The SID for the user's account.
. SIDs for security groups which the user is a member of in the
domain tailspintoys.com.
. SIDs for universal groups in the enterprise that include
either the user or one of the domain groups the user is a member of.
When the client receives the KDC's reply to its initial request, the client
uses its cached copy of the user key to decrypt its copy of the session key.
It can then discard the user key derived from the user's password, for it is
no longer needed. In all subsequent exchanges with the KDC, the client uses
the TGS session key. Like any other session key, this key is temporary,
valid only until the TGT expires or the user logs off. For that reason, the
TGS session key is often called a logon session key.
"NetSteady" <cmhutch at gmail.com> wrote in message
news:1128018776.867930.271990 at g44g2000cwa.googlegroups.com...
> I'm actually speaking about the enc-part of the Kerberos packet itself,
> not in the ticket. Is this the part you were speaking of?
>
> Our problem is that we're trying to validate the password for the user
> when we receive the AS-REP packet, but for some reason, we cannot find
> where to get the encryption key for the enc-part. We've read the RFCs
> (many many times) and are still having issues finding this.
>
> Suggestions?
>
> ________________________________________________
> Kerberos mailing list Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
begin 666 trsc_krb_117c.gif
M1TE&.#EA`@'F`/<``/D-$.\#">PG,-\&$]\3(.4S0,\)'-] 4-A-8+\,)M):
M<*\/+\QF@)\3.9D at 2<5SD)\Y8'\93'\93;^ H&\<5KB-L%\?7U]97U\@8']-
M at +*9P$\C:3\F<S\F<JNFT"\I?!\LAA\LA4]2::6SX \OCS],<A\_A2]&?+"_
MW\#,YN#F\]_E\@`SF0D\GPH\GP\_GQ _GP\YCQ],I2!,I2]9K#!9K#]FLD!F
MLD]RN%!SN5]_OV!_OW",QF^,Q7^9S("9S(^ETI"FTJ"SV9^RV*^_W[_,Y=#9
M[,_8Z_#S^>_R^ `YGQ-&I0`_I0\_CSELO]_K_^_U_P!F_P!&K ]O_Q]Y_R^"
M_S^,_T^5_U^?_V^H_W^R_X^\_Y_%_Y_ \*_/_[_8_\_B_Q]+AG^U__C[_Q],
MA;_;_P!Y_]_K^/+X_V^U_W^__YG,_Y_/_[C;_[_?_\7B_\SE_]+H_]CK_]_O
M_^7R_^OU_P""_Q^2_S^B_T^L_U^R_P",_P^/_P^2_R^?_S^E_S^H_R]9?&^\
M_Z_;_P"/_P"2_P^9_^CU_^_X_P"5_P"9_P^?_Q^E_R^L_S^R_T^X_U^\_U^_
M_V_%_X_2_Y_8_Y_/\*_?_[_E_\_K_]_R_W_,_S]E<S]F<J72X$^XL*O5T$]R
M:5^_H++8P'_,@%]_7[C<L&^,5K_?H)_88'^93,7BD*_?4,SE at +_E0)FO2=+I
M<)^R.=CL8*^_+]_R(+_,)M_O4.7R0,_8'.SV,._R"?G\$-_E$___`/_SX/^9
M`.^2"?^?$-^,$_^E(,^%'/^L,/^R0/^Y4/^_8/_&</_,@/_2D/_9H/_?L/_F
MP/_LT/_Y\+]_)J]Y+Y]R.8]L0G]F3&]?5O\``/] 0/]04/^ @/^PL/___P``
M`/___P``````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````````````"'Y! $``-T`+ `````"`>8```C_`+<)'$BPH,&#
M"!,J7,BPH<.'$"-*G$BQHL6+&#-JW,BQH\>/($.*'$FRI,F3*%.J7,FRY38<
M+&+*G$FSILV;.'/JW,FSI\^?0(,*'4HTJ(Z#+-8H7<JTJ=.G4*-*G4JUJM6K
M6+-JW<JUJU862+V*'4NVK-FS:-->!6LP*50/#QA4&*&VKMV[>//>95O0;5,%
M`*P)%@Q@@M[#B!,K/LR7H%^E71@,'I# P&##BS-KWLQY:N.!C]=HZ/+ `0F9
M)"Q;P]RYM>O7>#\+##T"P8"8-&S88)%:L ?8P(,+YRI[6V@!U@)0."IPR(O>
M!89+GTZ=:?''&I)_8.%CVPJ!1UZ$_Q!<H;KY\ZZO,U5 at +0(+&T<0;3MR!I,/
M%@NL'4#/OW]B]4L58$T'8*%1QQMR;'-)$2Q\$( U'!0EX8045FCAA1CRY(14
M`"HE((';6#*&&VO (1 0+$1 at 30:*M.CBBS#&*..,--9HXXTXYJCCCCSVZ../
M,H;65(=K? B6(H]D4D<<H*G((I!01BGEE%16:>6/0EH75H #'MFB)@)M89R3
M5Y9IYIEHIFEEEDL1:>0V+PH4Q9 at KJFGGG7CF>2:;2KG9)9PNRDFG!!D6:NBA
MB";ZDQ0P\KF&GQNPL,(ECK0H:(K69./2IIQV6A$+C7*XI5((6+,`"R_XD 2E
M`DU!IZ:>QO\JZZR.A1H5D14(MD (J*HZ$(,-9$KKL,2Z!.J+CA*Y1 at 6!6=,`
MKR_H)@,+%@BF3;'89EO2L2XF.^I2M0WV;$P=)" 8-MJFJVY'W+;H;5M0A3O8
M8-=<N^Z]^%+4KB+O]B45"! 0,!@&^19LL$/[]NL8AXU>% 0*!T<<:\*BPGMK
MPQ7=$-,,0DCL<4L4W_JM4PE7I (+./CP`@L<?^SR22%#I>R0&$^4`@LR;).$
MRBQ#_/+/(,7\U,S6U2S1S7SMO/(-*0#M]$9"DSPRS<A6A'1!2>@0$]-/=_VI
MK3)/7735%%UMT I:LW"#$5ZW_5#40XK=IM$1F7T0VBS H(+;?"O_!+>6%LM,
M-T17<V'%%P<=P<(/?3?>%MA#R]WGX ]=#8464QS>%N..=VX<Y%('/C3E#ME]
M^118/.$8YYXW_G>;DC]*>D.60R'0$UA$D?ILK#_$#4*_?\1-\" 1#_3K?<9>
M<MDQ;</%%%K8O at WN6O"NT/#8#W_]0L83A#WPQ?.-_*/*S\Z0V5]8`;WJJS?4
M/?C;PW_0^QK1?SSH<8M.LOD+V;W-%U?0'?N,T[N$&(]XW]L&`@7RO>S-CX$)
M=* "M<? "3HP at 1 ,W at 4'@D$)XFM\1)L;V6S6/"]$[W:YJQX!W>>]"E90 at RY4
MH SAM\ 9VE"#,(SA^W(XPQK6\%X at +-\(_X_6O">H[X338]_B6,C!&+Z0 at QND
M81-O.,4?6C&"5<RB$]451/U1K5M6:YY TH>Z`:Z0(0?<8@<+8K\>:I&*<(2C
M#]_(PS86JXO^NM at 0ZR;&@8 A=[L[(_=:2,4<+K"-==0A':?H1A?.T9&,7!<>
M%Z9',#*O.-2S'AH):4%%=A*"!FG@&S\9QRM2<((W/.4/)8D_P.51<'N," Q2
ME02_%;!U;9LD:!@62X at 880:HZL%WD')+7'9-E[/AI24M(@1 at LD 'PVR?,<77
M2MAY<6S+O$@S8P)-:4XSE]5,WC5%F$V,"$%C*"N")K_I-60:1YGN\D@*T&F#
M'K"@8^QL9SC)-__.R?4R(_.,"0R0D$]](JMBKQS=/S5BA!3LK:#'W&<(_5E.
MB%JT(>Y,%O\NRE'02%2(%>VH2&MU4)'U4W8+'6E',PI/?JGTI23M%D(I"<N0
MPI2C+*UD/#&"#&#XXJ>^(,8Q;NJRG-9TIQ5YAC& RE1?&*,71)68415J4X<X
MPZ>^F(8(8E(":OSBI\N(ZL&FNK^4+N09PO!%,$Z &QNLS 3#^&DR.&(_.Z;$
MKB+!JT?(^D6D2B09:HT!"WI0R^:P( ;1^"DR)I(]##XP?@9T+$3TBD;)8HNO
MV/1K1(CABPNP8 @$><,<BK"R"_S4&171JUWMF$:)4!:R-LP69LFI68C__#0&
M,LC$(EK4"$S$H0TKH $+H.'49U"DM9_TH?8\R,D64C""T%TN%%5IV;H^%Y6'
MG*YVV?71DRYO(C]]SR4B<0E-M&@2=("#XDKP4V DP[@1:6UV&RE#1,Z/?K][
M9"GCZ+WN'=**],UO)#,R6XK6]B'AM<$E+N&%;42B19EPPQAV<X%@M!<94/4=
M(?V;2E%N%X'2[6^(`\Q(`6^QO],=\1/IF\%3:J3 **TJ0V[[`@5Y`0R(:-$E
MT$"'(^R&!14&ZC$RO,E1DI+#\ENQ(O4+X%4^%LE--"0;0P+C[TJD&+[8:A$F
M(9\<*V(;F-@&&L90A!]?@+ at _'7*1(;GB1++6_[F<-#&)ESS at V+HYE(MT,D:J
MO-&$*,,7T'@/(AH1)T5$(A-C&'.9N8IF7QP#M0:,\W4=2=W(3CK%I92S<EV,
MZ0_C68?4?>W;NIO0LLKXK#XM`7<PL5L=*P(3FI $HM'@G;25`,W @*_C1'U9
M4M.4J@=^"&!_(=@A8((1+J($(C*!B%AC(M%CP!L+1/#5Q?;-LF/U]2YUZE*+
M8!D:@NW. at C%Q!-!>`A/-?L0EH+T"F(C at M&*5%9_-RI!G<'88 at I5!#WR@@Y71
MH B(D,0E$$$)\H[!=L(EKC'"%^^(S/O4#7%&6G\Q#;;&) :>774C)$&);5!"
M$E#@`H-,\-/[<IHDR/]=J;:3R>WB2.09R `J-&;^U;6R0)U)D 0C.HZ(+SQ!
M:\2%="1Y?1$]7_3AP9Z(,YB15J!.7+ LH,$V$#'HCH,!)L1MQI1-OMWD?AC;
M/#QRG5VW\G>VW"/.:(;:T:I6$:B:!C0P=IAA<H*OZAJ*6Z]OWMFL]Q/+>;]$
M?QG2NQV2JP)5U;WJ][2_JHS(ICB_!Y1OE.OLV,9.WIB#=SE'FG$,+/\T&#-Y
M-S#".LC8XOWT=_:[)Z<<^**67:/TWL at RL#H,FH,UR8D<L)25O,-%CMUQF4_)
M,SP/U(5;.O(X!+$I5S_T#.Z]=<%72=K7[K'6N[ZD8?-NGU]J_>O+U*2E[BO_
MX1MNT>B3O_RO;ZGFSX]+\[,_G^Y__S?C+W_,I__L]6<G_?/ON<$S05$`&( "
M.( 5<G]'I2<(F( *N( XHC#;=H ,&($2.(%VXH L!X$4F($:N($^8H%FAX$<
M&((B.(+N,E,/.#0$F((JN((LN!,N8((7Z!\R.(.M,5$T>(,X:!<VF(,\V(-B
ML8,^&(1"6!5 .(1&>(36%'Y+\0FJP JET E(&(4^2#2OH N\<(57J NG((5<
M2(/*4 at FL@(6[0 NW@(5;V(5HB![*(@J5H JNT 0RT01ER MGF(9V*!W*T at FQ
ML MMM1MR>(6?<(>"&!S*@@N\D NFP!S;X!Q_: N#__B(Z?$MHG"(@< =W@$>
M+T &5U@*D-B)FD$DK\ +J? >\3$?]7$?LL +M>")K/@?WV(+O, )8#$'=( @
M"L(@@9 +O+ )+=B+OOB+%K(AX/=KL"B+VY )=- &)7(B+) *O# *)!B-TJB
M'O at 8Q0@6BZ )F8 &"3(&QN&,T#B-XCB.:%*-3'&-@&)H`L$%W_B,Y/B.\#@E
MYK at 4Z!@GVS GS>B.\;B/_*@C\Z at 4]1 at H]]B.X;B Z0 at C!RF!"0DE"VDI_?A]
MV9=0L @*DD(IEC*0^5B0:G(0-=*0A=:1`_$C'JDC'$DC(QDHTOB/:Q +O" +
MO;(JCM J!(F )XF2'7F3-O_)(S5)DCBRDSLI at 2I9"E<H"V3PDK_"`K"@CWER
MD.D8DE]FDR%)$#+2D' B$!<)*%+Y95$ID%9YE1[)E%SID&+IE%DI at BJY!J5@
MA;P`"T49+38P+:1PA9Y DQ_9E$]YEW8YDE1)E7>)ESF9ESF)D'6)DE at IEGX9
MC6>Y!GJ(A6P9$YQ "U>X"@D(EGWID$TIE4S9E9=9E0BYE6/YEX09F!_YF86V
MF9J9DC#X at 4VQF%B(A:TPEY,YF/9HEZ,9(PG)F:!)F[39E[A9F;59F+,IFKX9
M at HG)%&& "K. A:' @)0)F(?YE"<)EI0)G5 )FI8IG(;YG+@)G,\Y at L5)6PHY
MFF3_"95=J94F.9ZSV9N7R9OD69Z"^9>G.9;NZ9X<^)T&]I D^)/X:2/V&6/[
MR8%.^9] TI_[(J &^I\$>J **J )NJ .VH\-^J 2^HX1VB+_!XP8FJ$:>A-*
M8(# -G[\!WT>:FI)%Z+4A'V1HWVQ9Z)/LW\L>J(0F:)*")[K]Z(1A:*A,Z/W
M6:,VZC0N&A'+8 S%,*3%@ RDUZ.S\J,/H0Q8U52-AZ3R-J+BQZ,*,7P_-0S3
M4 )=A6;"('10NBE*RA">5PTU06V^``Q:MQ%U%2O=5W0J$:8*L0R^\ ML10-$
M4$M'H#4G8&&^<*23U5AO!ELFUWIMVF*LA*/YHZ/^":(0_X%EU/!,! $':' ?
M,2 -9WIW\<5$D;:I)Z:IJ=5<O8:HKO1K),JH".8+)O "B/ (CN (DG (;A '
M1+ R%F9MC"5IN== 8/= S]6KOJII'51=P'-=(P:LRK=74II9INH0"48IFE I
MC' )<# '1 !D/U4,:9JI><9W?_=\H(1G3%9B_'5ZXJI*ES=?IK=GR4JC%=&L
ME@`&VU IBX (;; -TV*IU\H,VLIWO!=%SM=AIN>ON5=(OX=*+=:M)A9V%G1R
M%P&G"1%>,H (E[ %4( )7T('U/I6^.H+PN"GI<>O8@>JH/IWZ#JP)5MZ4-9F
M:D1EZ[JC%<%9JK8"DS ]<*()7/\F9DK#`B8@#5_%L1Z+>W1&8H&J9 3+K>5*
M>1MV>7$6M.G:L"V[J%2*$#$G#<^4":U*:)J@"3LG9FB0LS'@53_5L9BZ=\<J
M1Y4VK)=FJ%>T7PL[J"*F>J!6MASAL C1"S]E`BQ !);@(EFK" 77<6C0M4,P
M+5_;L\30.H7J*72+$,?@"\. *D= "2]R:!(;"1V7:(M(N-/P4T_*-]AF,(M[
M$&PW#:A2!)F0M9.0!"L at L1+[")J "(&;N2Q #9?ZI2PKJDE(JE-Z$89'M<]$
M!$4P!,)%6)C 99<@":]+:TE JX[&<$@:N at C!##\%#5LU$WC[`GJ["+*6"9(P
M"4_P!4/_P +L!0QNBQ(IAU-/:V45X0R<-:?4\+[$)0TQ\ *K&Z^'QFQ<``6[
M$5=$YD2)JV&=BGZX*TZ*JKX6H0PQUU2.BS,VH .(8 F6<&C_8T]9YZW_>F27
M%EWXY;_F&L P6H+#>(*E&K4/T0O*D PH;'C1`'4]T .1.[,H$@,6UK_?>K0C
MR[2]AUSH*J(#S$\%O'T5(:= A;<X$[PP`5=.Y7@':[ U++24YV*61[3]E[Y
M7!'*T'3!``V^>W%?-50H>U\HYL1P:W3=VCG0:Q&-^U/3\+Z)Y0MS]5A&JWM&
MJV?A6K!]<\86L71-VEYCVVG_&JS+-ZYV=L$>?,=4O*(<\0PG_XS"^BHQ_PNZ
MAPQQ,/7(D-S#-FC MNNCD5RBF?PQ>-S)AQJC.:J[RDK"H)POGWS*VI+*JARJ
MHIRHI,RNK7P_E at Q2G#S+J+S)RUH11O #OOS+P!S,/Q $38/+4*/+IKP0*E #
M0L$#!&7,ZEK+*BK)#6$$, "I"@&O! $$+P`#/@/-7R/-/XS("B$$U^P#B-!J
M,@(F:5 (+1*M*[ ;-_!0X"P1K"P0/Q 3QD9H-=((F? %=^ BDH (W*PW]6S/
MR'P1^8R]K(8CBS )4& '+A*MU5I,!^TW"6T1P%0$EJ#.,I*-FD!HC/ $>9"U
MR!8)X1L$%PT1]]P\-N+/`C%HCO %<_]@L^FL"?=1S"N-41G]*5Y"(V$V$,LF
M!LCFMYB0";OQS#O-$"W]TS+2<04!!7S@(HN0">&;S!?=U![)"&!B$(,`(X@@
M7/BTU$S=T_KBU(K ".25$)#P(HZP`BS `^I"J$F6R^(<RRYK$2Y-U?*A$'_P
M(IK (#L`6XG+7)[ZL8+Z068]$7O=(I; $&! "!.-"#"ATY]6R YQOHB]V76M
MV'<MPKNKUTX-U0NA!B_R",L[4$![P5C$:1N\7% ,R(;:M@!;VURTV/;LU)'@
M$(#P(I0 at V*L-99 'QV%<QR<[R*R'V<1RSS/P`DGP""_RV N!"'@@T(A0K8--
MW#@D8BHFLAW_EL%+K%_?W4.4;!+WG,\X,&@3O1"1D AQLAL&K=W%;<%-2\=&
M)MZIU\2KC-L2H3$]H%LM0MH(89LL4 /??-D!R[0(KFF^=]R2)\7E/1+WO U(
MP,S&I@@QN1 $;MGE2TI>=WP<C'QEN[;CG7R>_<JC"MJEG!'6S )'@&X+`08O
M\M HPN%DG1 3O at WYC"H,P0:&< D#D00_IM0WCM&?'8,CC!$G\P+[IA![@) R
M`0-C7>1&CN*YJ^*R;!$[P!U at H$((80;N'2@;PS947M9'KII);A%(<,U)8 5S
MDA!>H =Q0EHU0.1ECA#W' 3/] 11$ 5B at A!0``5^$"A0$+XY<.<+],'<+IX[
M?<Z.!Y$%6? $?6!H3T %3V!/%HWHGW/FL$?-"($"[P$%4]#G?7X%VCP06]#H
M92 (3U %45 %^LL"!Z[I'L7IZJ?E*",1I\Z,F7[GK"P$%S+KM+[I5D[ > VU
M%]'+PKSLS [,PC[L.3[L0</?TMXIT5[MW&7KW*8$&]KMWHZANCRAXDZ"%3KN
MYDZ<J=GIY[[N&ECN[/[N#.CN\#[O>M*?2_#M^)[O&MH"Z=Z*_HZ'L?/O`K\8
M13CP!A\;`7_P"J^#";_P#G\6!?_P$N\5$3_Q%I\5%7_Q&D\5UZ'O'O_Q("\3
0-8;M)%_R)G_R*#\K`0$`.P``
`
end
More information about the Kerberos
mailing list