Bibliographic Details
| Title: |
Breaking and fixing public-key Kerberos |
| Authors: |
Cervesato, Iliano1, Jaggard, Aaron D.2, Scedrov, Andre3, Tsay, Joe-Kai3 jetsay@math.upenn.edu, Walstad, Christopher4 |
| Source: |
Information & Computation. Feb2008, Vol. 206 Issue 2-4, p402-424. 23p. |
| Subjects: |
Computer network protocols, Microsoft Windows device drivers (Computer programs), Authentication (Law), Data protection |
| Abstract: |
Abstract: We report on a man-in-the-middle attack on PKINIT, the public key extension of the widely deployed Kerberos 5 authentication protocol. This flaw allows an attacker to impersonate Kerberos administrative principals (KDC) and end-servers to a client, hence breaching the authentication guarantees of Kerberos. It also gives the attacker the keys that the KDC would normally generate to encrypt the service requests of this client, hence defeating confidentiality as well. The discovery of this attack caused the IETF to change the specification of PKINIT and Microsoft to release a security update for some Windows operating systems. We discovered this attack as part of an ongoing formal analysis of the Kerberos protocol suite, and we have formally verified several possible fixes to PKINIT—including the one adopted by the IETF—that prevent our attack as well as other authentication and secrecy properties of Kerberos with PKINIT. [Copyright &y& Elsevier] |
|
Copyright of Information & Computation is the property of Academic Press Inc. and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) |
| Database: |
Engineering Source |
