Re: Heimdal/AFS Master Key Coordination

[joda@pdc.kth.se (Johan Danielsson)]

"Henry B. Hotz" <hotz@jpl.nasa.gov> writes:

> Now about the hpropd: Does it encrypt the database using the master
> key in the stash file?

No, hpropd is really simple, it just reads entries and writes them to
the database, it doesn't know much of anything.

> There was a recent post to the effect that hpropd couldn't tell if
> it was getting encrypted data or not.

An application that requires access to key material, will decrypt if
necessary. In fact, you can have keys encrypted with different master
keys, and unencrypted keys in the same database (not that I recommend
that).

> So the kaserver DB is unencrypted; the Heimdal DB is encrypted.
> When/how is the encryption with the Heimdal master key done?

By hprop, if used with --encrypt.

/Johan