International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Breaking and Fixing Public-Key Kerberos

Authors:
Iliano Cervesato
Aaron D. Jaggard
Andre Scedrov
Joe-Kay Tsay
Christopher Walstad
Download:
URL: http://eprint.iacr.org/2006/009
Search ePrint
Search Google
Abstract: We report on a man-in-the-middle attack on PKINIT, the public key extension of the widely deployed Kerberos 5 authentication protocol. This flaw allows an attacker to impersonate Kerberos administrative principals (KDC) and end-servers to a client, hence breaching the authentication guarantees of Kerberos. It also gives the attacker the keys that the KDC would normally generate to encrypt the service requests of this client, hence defeating confidentiality as well. The discovery of this attack caused the IETF to change the specification of PKINIT and Microsoft to release a security update for some Windows operating systems. We discovered this attack as part of an ongoing formal analysis of the Kerberos protocol suite, and we have formally verified several fixes to PKINIT that prevent our attack.
BibTeX
@misc{eprint-2006-21503,
  title={Breaking and Fixing Public-Key Kerberos},
  booktitle={IACR Eprint archive},
  keywords={cryptographic protocols / PKINIT, man-in-the-middle attack},
  url={http://eprint.iacr.org/2006/009},
  note={Submitted to WITS'06; will be revised before publication if accepted. icervesato@gmail.com 13157 received 9 Jan 2006},
  author={Iliano Cervesato and Aaron D. Jaggard and Andre Scedrov and Joe-Kay Tsay and Christopher Walstad},
  year=2006
}