Subject: Re: Fwd: I-D ACTION:draft-ietf-cat-kerberos-set-passwd-05.txt

From: Nicolas Williams <[email-masked]>
Date: Fri, 27 Apr 2001 14:43:34 -0400

How is salting of passwords handled? I see no field in which a password
salt is transmitted by either the client or the server.

Are password salts:

 - defaulted according to realm policy (e.g., salt == principal name or
   salt == realm name)?

 - returned to the client by the KDC as pre-auth data in error AS_REPs?

Nico

On Fri, Apr 27, 2001 at 11:04:03AM -0700, Jonathan Trostle wrote:
> I submitted an update to the change/set password draft. The main changes to
> this version of the draft are:
> 
> (1) formatting
> (2) added section including the relevant Kerberos data type definitions (in
> response to Mike Swift's comment)
> (3) changed the port numbers from MUST to SHOULD (response to Ken Raeburn's
> comment)
> (4) changed the minor status back into a result string and added a result
> string length (see user data part of the reply message). This change is in
> response to Sam Hartman's concern on interoperability with the minor status
> indexing into a string catalog approach.
> (5) added acknowledgements
> 
> Jonathan
> 
> 
> 
> >To: IETF-Announce: ;
> >Cc: [email-masked]
> >From: [email-masked]
> >Reply-to: [email-masked]
> >Subject: I-D ACTION:draft-ietf-cat-kerberos-set-passwd-05.txt
> >Date: Thu, 26 Apr 2001 07:21:44 -0400
> >Sender: [email-masked]
> >
> >A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >This draft is a work item of the Kerberos WG Working Group of the IETF.
> >
> >	Title		: Kerberos Set/Change Password: Version 2
> >	Author(s)	: J. Trostle, M. Swift, J. Brezak, B. Gossman
> >	Filename	: draft-ietf-cat-kerberos-set-passwd-05.txt
> >	Pages		: 12
> >	Date		: 25-Apr-01
> >	
> >This proposal specifies a Kerberos (RFC 1510 [3]) change/set password
> >protocol and a Kerberos change/set key protocol. The protocol
> >consists of a single request and reply message. The request message
> >includes both AP_REQ and KRB_PRIV submessages; the new password is
> >contained in the KRB_PRIV submessage which is encrypted in the
> >session key from the ticket.
> >
> >A URL for this Internet-Draft is:
> >http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-set-passwd-05.txt
> >
> >Internet-Drafts are also available by anonymous FTP. Login with the username
> >"anonymous" and a password of your e-mail address. After logging in,
> >type "cd internet-drafts" and then
> >	"get draft-ietf-cat-kerberos-set-passwd-05.txt".
> >
> >A list of Internet-Drafts directories can be found in
> >http://www.ietf.org/shadow.html 
> >or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> >
> >
> >Internet-Drafts can also be obtained by e-mail.
> >
> >Send a message to:
> >	[email-masked].
> >In the body type:
> >	"FILE /internet-drafts/draft-ietf-cat-kerberos-set-passwd-05.txt".
> >	
> >NOTE:	The mail server at ietf.org can return the document in
> >	MIME-encoded form by using the "mpack" utility.  To use this
> >	feature, insert the command "ENCODING mime" before the "FILE"
> >	command.  To decode the response(s), you will need "munpack" or
> >	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> >	exhibit different behavior, especially when dealing with
> >	"multipart" MIME messages (i.e. documents which have been split
> >	up into multiple messages), so check your local documentation on
> >	how to manipulate these messages.
> >		
> >		
> >Below is the data which will enable a MIME compliant mail reader
> >implementation to automatically retrieve the ASCII version of the
> >Internet-Draft.
> >Content-Type: text/plain
> >Content-ID:	<[email-masked]>
--

---

From: Jonathan Trostle <[email-masked]>
Date: Fri, 27 Apr 2001 11:04:03 -0700

(1) formatting

Jonathan

directories.

---

From: Jonathan Trostle <[email-masked]>
Date: Mon, 30 Apr 2001 11:00:32 -0700

In the change/set password case, the salt is calculated and stored by the
KDC. In the change/set key case,  see the KeySequence field. Regarding salt
format, each etype determines what format (if any) the salt has.

Jonathan