[krbdev.mit.edu #9166] git commit
"Greg Hudson via RT" <[email protected]> Thu, 13 Mar 2025 19:17:48 -0400
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
Thu Mar 13 19:17:48 2025: Request 9166 was acted upon. Transaction: Ticket created by [email protected] Queue: krb5 Subject: git commit Owner: [email protected] Requestors: Status: new Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9166 > Add PKINIT paChecksum2 from MS-PKCA v20230920 In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2 element in the PKAuthenticator sequence. This checksum accepts SHA-1, SHA-256, SHA-384, and SHA-512 digests. In Windows Server 2025, this checksum becomes mandatory when using PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as allowed). [[email protected]: refactored crypto interfaces to reduce complexity of calling code] https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00 Author: Julien Rische <[email protected]> Committer: Greg Hudson <[email protected]> Commit: 310793ba63782af5ffa3a95d20e41f8f03ca7e00 Branch: master src/include/k5-int-pkinit.h | 25 +++-- src/lib/krb5/asn.1/asn1_k_encode.c | 18 +++- src/plugins/preauth/pkinit/pkinit.h | 1 + src/plugins/preauth/pkinit/pkinit_clnt.c | 41 +++----- src/plugins/preauth/pkinit/pkinit_constants.c | 42 ++++++-- src/plugins/preauth/pkinit/pkinit_crypto.h | 24 ++++- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 116 ++++++++++++++++++++- src/plugins/preauth/pkinit/pkinit_kdf_test.c | 6 +- src/plugins/preauth/pkinit/pkinit_lib.c | 16 ++- src/plugins/preauth/pkinit/pkinit_srv.c | 38 ++----- src/plugins/preauth/pkinit/pkinit_trace.h | 5 +- src/tests/asn.1/krb5_decode_test.c | 2 +- src/tests/asn.1/ktest.c | 7 +- src/tests/asn.1/ktest_equal.c | 2 +- src/tests/asn.1/pkinit_encode.out | 2 +- src/tests/asn.1/pkinit_trval.out | 2 +- 16 files changed, 251 insertions(+), 96 deletions(-)