Re: Checksum in mk_req_internal

[joda@pdc.kth.se (Johan Danielsson)]

"]ke Sandgren" <ake@cs.umu.se> writes:

> The problem is that the kdc (DCE secd in this case) returns error

Try this:

--- mk_req_ext.c	1999/02/11 21:03:44	1.19
+++ mk_req_ext.c	1999/04/16 09:41:09
@@ -94,6 +94,15 @@
   krb5_copy_keyblock(context, &in_creds->session, &ac->keyblock);
   
   if (in_data) {
+      if(ac->keyblock->keytype == ETYPE_DES_CBC_CRC) {
+	  /* this is to make DCE secd happy */
+	  ret = krb5_create_checksum(context, 
+				     NULL,
+				     CKSUMTYPE_RSA_MD4,
+				     in_data->data,
+				     in_data->length,
+				     &c);
+      } else {
       krb5_crypto crypto;
       krb5_crypto_init(context, ac->keyblock, 0, &crypto);
       ret = krb5_create_checksum(context, 
@@ -104,6 +113,7 @@
 				 &c);
       
       krb5_crypto_destroy(context, crypto);
+      }
       c_opt = &c;
   } else {
       c_opt = NULL;

> What i can't understand is why init_crypto/create_checksum is done
> the way it is.

You mean in general, or just in this part of the code? I think the
general idea is that the encryption type should tell you what checksum
to use, but DCE uses keytypes, not enctypes.

/Johan