[krbdev.mit.edu #9084] git commit

[Greg Hudson via RT]

Tue Jan 24 03:03:01 2023: Request 9084 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9084 >



Add PAC full checksums

A paper by Tom Tervoort noted that computing the PAC privsvr checksum
over only the server checksum is vulnerable to collision attacks
(CVE-2022-37967).  In response, Microsoft has added a second KDC
checksum over the full contents of the PAC.  Generate and verify full
KDC checksums in PACs for service tickets.  Update the t_pac.c ticket
test case to use a ticket issued by a recent version of Active
Directory (provided by Stefan Metzmacher).

https://github.com/krb5/krb5/commit/4602a10dbe380d75d1ec00f7d34479ac9d503735
Author: Greg Hudson <ghudson at mit.edu>
Commit: 4602a10dbe380d75d1ec00f7d34479ac9d503735
Branch: master
 doc/appdev/refs/macros/index.rst |   1 +
 src/include/krb5/krb5.hin        |   1 +
 src/lib/krb5/krb/pac.c           |  92 +++++++++++----------
 src/lib/krb5/krb/pac_sign.c      | 146 +++++++++++++++++++--------------
 src/lib/krb5/krb/t_pac.c         | 171 +++++++++++++++++++++++----------------
 src/tests/t_authdata.py          |   4 +-
 6 files changed, 240 insertions(+), 175 deletions(-)