SSL and Kerberos

From: Leland T. Snyder (ltsnyder@x3ci.com)
Date: 02/07/03

  • Next message: Leland T. Snyder: "Re: openSSL Key generation" 
    From: "Leland T. Snyder" <ltsnyder@x3ci.com>
To: <focus-linux@securityfocus.com>
Date: Fri, 7 Feb 2003 12:23:15 -0500

    Is there any rational in using SSL and kerberos? Let me explain before you
    say no.
    Let's say I have a service that you log into using SSL.
    Since the public key and private keys are the same and the handshake is the
    same (i.e. you know the first packets are for login/password) even thoe as a
    sniffer of the packets I can't read them. I could still spoof the clients
    encrypted packets and at least make the service think it has a valid client,
    even thoe I still can read the packets (I just can fake the initial protocol
    with the unreadable packets I sniffed). Since Kerberos has a time based
    factor for the public key an additional level of security exists while SSL
    lacks this.

    Thanks in advance for your help.

    -Leland

    Relevant Pages

    • Re: [Full-Disclosure] idea (quite a bit off-topic, but....)
      ... it is functionally equivilent to just opening a single connection. ... with the symmetric key you got from the server, and send it UDP to a fixed ... After a random number of packets, reconnect with ssl, assert the unique id ...
      (Full-Disclosure)
    • Re: DCPROMO RPC error
      ... Over the weekend I was involved in Joining a Windows 2003 server in the US to our domain here in Sydney over an IPSEC VPN. ... Kerberos uses connectionless UDP datagram packets. ... Depending on the virtual private network hardware configuration, these larger packets have to be fragmented when going through a VPN. ... Because UDP is a connectionless protocol, fragmented UDP packets will be dropped if they arrive at the destination out of order.If you change MaxPacketSize to a value of 1, you force the client to use TCP to send Kerberos traffic through the VPN tunnel. ...
      (microsoft.public.windows.server.active_directory)
    • Re: DCPROMO RPC error
      ... Promote a Domain Controller over an IPSEC VPN - Kerberos over tcp - ... Kerberos uses connectionless UDP datagram packets. ... you change MaxPacketSize to a value of 1, you force the client to use TCP ...
      (microsoft.public.windows.server.active_directory)
    • Re: kerberos AD: keytab and service principal not needed?
      ... I posted details about the kerberos udp/tcp packets. ... By creating the keytab, you have a "shared secret" between the KDC ... I did run tcpdump on two hosts, looking for kerberos protocol packets. ...
      (comp.unix.aix)
    • Re: Spoofing IP Addresses when sending emails
      ... configuring his router to reject packets coming from the outside world which have a source address that belongs to the local network. ... i'd double-check my assumption that the packets really aren't coming from a local machine. ... My ISP has used SSL for a long time to ID customers connecting to it's email server. ...
      (comp.lang.java.programmer)