Migrating a Kerberos Realm

[Ken Raeburn]

On Nov 3, 2006, at 09:32, Douglas E. Engert wrote:
> But the salt is returned in the KRB_ERROR   
> KRB5KDC_ERR_PREAUTH_REQUIRED(25)
> message on the PA_ENCTYPE_INFO in clear text so just having a  
> different salt
> per principal should make it just as difficult for the attacker.

If the salt string is randomized on password changes, the attacker  
would have to rebuild his list of keys (except for RC4).  If it's  
kept the same for a given user principal, he can keep using the same  
precomputed list.

Ken