Your KDC produces invalid ASN.1

[Sam Hartman]

>>>>> "Luke" == Luke Howard <lukeh at PADL.COM> writes:

    Luke> Indeed, this breaks the Sun shipped Kerberos libraries
    Luke> (hardly surprising). Fixed in our KDC, but I'll wait the
    Luke> "official" fix from Heimdal.

I'm surprised it breaks with Sun.  The change that is causing this to
fail seems to have been introduced in Kerberos 1.3-- and has to do
with etype-info2.