Re: a potential security hole?

> >    First, Bob updates a bogus pair (FQDN: BAD, IP address: IPb)
> >    of his naming system. Then, he initiates KINK for BAD@REALM.
> >    KINK on A starts KINK message. X that is a intermediate box
> >    between A and B can impersonate B because X can understand
> >    a ticket for BAD@REALM.
>
>I assume here that "X" is the attaker, not Bob?
>Otherwise I'm really confused because why would
>Bob update his naming to point at "BAD"? Are
>Bob and X somehow in collusion?

I'm a bit confused as well ... because if X know's B's key, then for
the purposes of Kerberos, X _is_ B, and that is something Kerberos
explicitly does _not_ deal with.

--Ken