[krbdev.mit.edu #9166] git commit

[Greg Hudson via RT]

Thu Mar 13 19:17:48 2025: Request 9166 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9166 >



Add PKINIT paChecksum2 from MS-PKCA v20230920

In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2
element in the PKAuthenticator sequence.  This checksum accepts SHA-1,
SHA-256, SHA-384, and SHA-512 digests.

In Windows Server 2025, this checksum becomes mandatory when using
PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as
allowed).

[ghudson at mit.edu: refactored crypto interfaces to reduce complexity of
calling code]

https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
Author: Julien Rische <jrische at redhat.com>
Committer: Greg Hudson <ghudson at mit.edu>
Commit: 310793ba63782af5ffa3a95d20e41f8f03ca7e00
Branch: master
 src/include/k5-int-pkinit.h                        |  25 +++--
 src/lib/krb5/asn.1/asn1_k_encode.c                 |  18 +++-
 src/plugins/preauth/pkinit/pkinit.h                |   1 +
 src/plugins/preauth/pkinit/pkinit_clnt.c           |  41 +++-----
 src/plugins/preauth/pkinit/pkinit_constants.c      |  42 ++++++--
 src/plugins/preauth/pkinit/pkinit_crypto.h         |  24 ++++-
 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 116 ++++++++++++++++++++-
 src/plugins/preauth/pkinit/pkinit_kdf_test.c       |   6 +-
 src/plugins/preauth/pkinit/pkinit_lib.c            |  16 ++-
 src/plugins/preauth/pkinit/pkinit_srv.c            |  38 ++-----
 src/plugins/preauth/pkinit/pkinit_trace.h          |   5 +-
 src/tests/asn.1/krb5_decode_test.c                 |   2 +-
 src/tests/asn.1/ktest.c                            |   7 +-
 src/tests/asn.1/ktest_equal.c                      |   2 +-
 src/tests/asn.1/pkinit_encode.out                  |   2 +-
 src/tests/asn.1/pkinit_trval.out                   |   2 +-
 16 files changed, 251 insertions(+), 96 deletions(-)