Re: pkinit broken in 1.5 against heimdal-kdc 1.2

Guido Günther <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.heimdal.general
Message-ID <[email protected]>
Hi Love,
On Sun, Dec 18, 2011 at 02:03:09AM +0000, Love Hörnquist Åstrand wrote:
> Hello,
> 
> Can you try changing the variables
> 
> 	_hx509_crypto_default_
> 
> in lib/hx509/crypto.c to use sha1 instead of sha256 ?
Thanks for the hint. That alone didn't help but moving up the sha1 in
the list of signature algorithms did (see attached patch).
Can we somehow autodetect old KDCs to force this behaviour?
Cheers,
 -- Guido
Use-sha1-instead-of-sha256.patch (text/x-diff, 1.4 KB)
From: =?UTF-8?q?Guido=20G=C3=BCnther?= <[email protected]>
Date: Sun, 18 Dec 2011 13:26:45 +0100
Subject: Use sha1 instead of sha256

---
 lib/hx509/crypto.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/hx509/crypto.c b/lib/hx509/crypto.c
index 4559a9c..17513d8 100644
--- a/lib/hx509/crypto.c
+++ b/lib/hx509/crypto.c
@@ -1448,6 +1448,9 @@ static const struct signature_alg md5_alg = {
  */
 
 static const struct signature_alg *sig_algs[] = {
+    &rsa_with_sha1_alg,
+    &rsa_with_sha1_alg_secsig,
+    &pkcs1_rsa_sha1_alg,
 #ifdef HAVE_OPENSSL
     &ecdsa_with_sha256_alg,
     &ecdsa_with_sha1_alg,
@@ -1455,9 +1458,6 @@ static const struct signature_alg *sig_algs[] = {
     &rsa_with_sha512_alg,
     &rsa_with_sha384_alg,
     &rsa_with_sha256_alg,
-    &rsa_with_sha1_alg,
-    &rsa_with_sha1_alg_secsig,
-    &pkcs1_rsa_sha1_alg,
     &rsa_with_md5_alg,
     &heim_rsa_pkcs1_x509,
     &dsa_sha1_alg,
@@ -1979,9 +1979,9 @@ hx509_crypto_aes256_cbc(void)
  */
 
 const AlgorithmIdentifier * _hx509_crypto_default_sig_alg =
-    &_hx509_signature_rsa_with_sha256_data;
+    &_hx509_signature_rsa_with_sha1_data;
 const AlgorithmIdentifier * _hx509_crypto_default_digest_alg =
-    &_hx509_signature_sha256_data;
+    &_hx509_signature_sha1_data;
 const AlgorithmIdentifier * _hx509_crypto_default_secret_alg =
     &_hx509_crypto_aes128_cbc_data;
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.