samedi 28 février 2015

Why first kerberos message is not ciphered



When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted.


In case not encrypted I give a possible attacker the knowledge of who I want to communicate with. As the Client and KDC shares the key we can encrypt it and therefore not provide that information which can be used as a basics to bruteforce attack using for the return and encrypted message (I know 2 of the parameters).


Maybe it is a silly question, but ...


Edit: I don't mean to have IDa ciphered but the rest of the information in the KRB_AS_REQ, as for instance the IDtgs. If you keep that open an attacker knows at least who do you want to talk and therefore the KRB_AS_REP can be exploit.





Aucun commentaire:

Enregistrer un commentaire