Re: pkinit broken in 1.5 against heimdal-kdc 1.2

Hello,

Can you try changing the variables

	_hx509_crypto_default_

in lib/hx509/crypto.c to use sha1 instead of sha256 ?

Love

17 dec 2011 kl. 04:47 skrev Guido Günther:

> Hi,
> while pkinit works fine with 1.2 client and 1.2 kdc using a 1.5 client
> with the exact same set of certificates against a 1.2 kdc gives:
> 
> $ kinit -C FILE:user.pem,user.key [email protected]
> 2011-12-06T23:32:31 using cert: subject: UID=user,DC=example,DC=com sn: 61A80F99A986854154595138D20BC368F27686F5
> 2011-12-06T23:32:31 krb5_get_init_creds: loop 1
> 2011-12-06T23:32:31 KDC send 0 patypes
> 2011-12-06T23:32:31 krb5_get_init_creds: prepareing PKINIT padata (ietf)
> 2011-12-06T23:32:31 Trying to find service kdc for realm EXAMPLE.COM flags 2
> 2011-12-06T23:32:31 configuration file for realm EXAMPLE.COM found
> 2011-12-06T23:32:31 trying to communicate with host kdc.example.com in realm EXAMPLE.COM
> 2011-12-06T23:32:35 result of trying to talk to realm EXAMPLE.COM = 0
> 2011-12-06T23:32:35 krb5_get_init_creds: loop 2
> 2011-12-06T23:32:35 krb5_get_init_creds: processing input
> 2011-12-06T23:32:35 krb5_get_init_creds: got an error
> 2011-12-06T23:32:35 krb5_get_init_creds: KRB-ERROR -1765328359
> 2011-12-06T23:32:35 KDC send 4 patypes
> 2011-12-06T23:32:35 KDC send PA-DATA type: 2
> 2011-12-06T23:32:35 KDC send PA-DATA type: 16
> 2011-12-06T23:32:35 KDC send PA-DATA type: 15
> 2011-12-06T23:32:35 KDC send PA-DATA type: 19
> 2011-12-06T23:32:35 krb5_get_init_creds: prepareing PKINIT padata (ietf)
> 2011-12-06T23:32:35 Trying to find service kdc for realm EXAMPLE.COM flags 2
> 2011-12-06T23:32:35 configuration file for realm EXAMPLE.COM found
> 2011-12-06T23:32:35 trying to communicate with host kdc.example.com in realm EXAMPLE.COM
> 2011-12-06T23:32:35 result of trying to talk to realm EXAMPLE.COM = 0
> 2011-12-06T23:32:35 krb5_get_init_creds: loop 3
> 2011-12-06T23:32:35 krb5_get_init_creds: processing input
> 2011-12-06T23:32:35 krb5_get_init_creds: got an error
> 2011-12-06T23:32:35 krb5_get_init_creds: KRB-ERROR -1765328359
> 2011-12-06T23:32:35 KDC send 4 patypes
> 2011-12-06T23:32:35 KDC send PA-DATA type: 2
> 2011-12-06T23:32:35 KDC send PA-DATA type: 16
> 2011-12-06T23:32:35 KDC send PA-DATA type: 15
> 2011-12-06T23:32:35 KDC send PA-DATA type: 19
> 2011-12-06T23:32:35 krb5_get_init_creds: prepareing PKINIT padata (win2k)
> kinit: krb5_get_init_creds: Already tried pkinit, looping
> 
> The server then has:
> 
> 2011-12-06T22:57:28 AS-REQ [email protected] from <IP> for krbtgt/[email protected]
> 2011-12-06T22:57:28 Client sent patypes: PK-INIT(ietf), 132
> 2011-12-06T22:57:28 Looking for PKINIT pa-data -- [email protected]
> 2011-12-06T22:57:28 PKINIT: failed to verify signature: Failed to verify messageDigest: 569861
> 2011-12-06T22:57:28 PKINIT: Did not find a plugin for windc
> 2011-12-06T22:57:28 Failed to decode PKINIT PA-DATA -- [email protected]
> 2011-12-06T22:57:28 Looking for ENC-TS pa-data -- [email protected]
> 2011-12-06T22:57:28 No preauth found, returning PREAUTH-REQUIRED -- [email protected]
> 2011-12-06T22:57:28 sending 407 bytes to <IP>
> 2011-12-06T22:57:28 AS-REQ user@EXAMPLE>COM from <IP> for krbtgt/[email protected]
> 2011-12-06T22:57:28 Client sent patypes: PK-INIT(win2k), 132
> 2011-12-06T22:57:28 Looking for PKINIT pa-data -- user@
> 2011-12-06T22:57:28 PKINIT: failed to verify signature: Failed to verify sigature in CMS SignedData: 569861
> 2011-12-06T22:57:28 PKINIT: Did not find a plugin for windc
> 2011-12-06T22:57:28 Failed to decode PKINIT PA-DATA -- [email protected]
> 2011-12-06T22:57:28 Looking for ENC-TS pa-data -- [email protected]
> 2011-12-06T22:57:28 No preauth found, returning PREAUTH-REQUIRED -- [email protected]
> 2011-12-06T22:57:28 sending 407 bytes to <IP>
> 
> 569861 is HX509_SIG_ALG_NO_SUPPORTED.
> 
> Non-pkinit auth works as expected. This is Debian's 1.5.dfsg.1-3
> heimdal. Any ideas besides upgrading the KDC?
> 
> Cheers,
> -- Guido
> 
> P.S.: this is http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651236