Rocksolid Light

Welcome to Rocksolid Light

mail  files  register  newsreader  groups  login

Message-ID:  

Pie are not square. Pie are round. Cornbread are square.

devel / comp.protocols.kerberos / Re: Using PKINIT with ECC

SubjectAuthor
o Re: Using PKINIT with ECCGoetz Golla

1
Re: Using PKINIT with ECC

<mailman.13.1706252490.2322.kerberos@mit.edu>

  copy mid

https://news.novabbs.org/devel/article-flat.php?id=1080&group=comp.protocols.kerberos#1080

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: mit@sec4mail.de (Goetz Golla)
Newsgroups: comp.protocols.kerberos
Subject: Re: Using PKINIT with ECC
Date: Fri, 26 Jan 2024 08:01:12 +0100
Organization: TNet Consulting
Lines: 45
Message-ID: <mailman.13.1706252490.2322.kerberos@mit.edu>
References: <8984fe41-f9a0-434b-a09c-df2bc88125dc@sec4mail.de>
<ae76ed5c-1399-401e-988c-ed2dbdfff6e7@mit.edu>
<81bc4460-b88a-4dfe-b538-e22805a086ea@sec4mail.de>
<202311191733.3AJHXASl018607@hedwig.cmf.nrl.navy.mil>
<414fe2a9-56ad-4401-b72a-4c002405e56c@sec4mail.de>
<202311242047.3AOKlYk3019409@hedwig.cmf.nrl.navy.mil>
<ffeca0f8-2646-4c63-88b2-e696f52bf24b@sec4mail.de>
<202401111441.40BEf6HH019591@hedwig.cmf.nrl.navy.mil>
<81773b85-0be5-4412-9d64-ca94b2cdd2b7@sec4mail.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="23455"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla Thunderbird
To: kerberos@mit.edu
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=EbTFn7J/;
dkim=pass (2048-bit key,
unprotected) header.d=sec4mail.de header.i=@sec4mail.de header.a=rsa-sha256
header.s=default header.b=eRAi/EOc
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=GOJU56Isa0iqdEnbz2hJExhh+WWMdilGgeWLWEHCRJucLS7yaMys+sb6PtB7XazOCL0ryeKRZZln1msEVq/JOztCODqcrGqZVgzw8Bw/u0qzDkK8GWeJFlEAPidgEBOTbqeaGpdj//uB/6+0M9Z14cIZIs7JW5ys78pJA9wrVxhhS2Qudh2K5GU1zrTtej4s1AgBC1LXEKzbqwh+VeDqCDSABjCtHdIYHwv7iobj3MdrBPBYiIa+lUK5YBO59OkOifi+UtE3HaPcCeFm03Cx7lf5PfRnQsrbn2ZGNVTlCYeflMw7sw5c8wMNn7C61TUcCONtkUJWyJ1iWES3iMardA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=T048Pih9pVmLWHX+WWmJITtXnnhX6ooL76gRuldJ0Qc=;
b=E9SFQ6fo2MoMQ1n3WaJxKvRgVZFBeppCQwKxTNmJ35HshkC2pOrFEtK2taRkD3G2BRTjvzkbIFgoSwGeZyTBPUXzUCEHdnOfbyM+2w+a/7UdHA8mQp5JIyd9n40w5ilKJp2AACBQPbw3WukZ7u6zTV9VPWEVo3nOvp5k2ou/LXgMhPNfFydo8YfGlqeFs8NCWgMWTX2kTIqUZDgIBOQ2pqBIpkoCiUpjB/nqo8D09jsU1pnGn7r2t4FZlICPQZHN2ruSlSuPk75x5DUObsp15d0HuXEQA4eyXU77XQOCBg+3uWY97Q6bZDtzurN9tllc02qaAymxJPJZPPNHLL7DIg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
31.220.85.254) smtp.rcpttodomain=mit.edu smtp.mailfrom=sec4mail.de;
dmarc=bestguesspass action=none header.from=sec4mail.de; dkim=pass (signature
was verified) header.d=sec4mail.de; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=T048Pih9pVmLWHX+WWmJITtXnnhX6ooL76gRuldJ0Qc=;
b=EbTFn7J/+GR2gn+ekumJ5lxaGvsQymMi30f/fT1LemP23jsmTDSNHDpjkL+ogeXLYA+XneML7TTHTdd/D34oYfRI6zzLod/WUtYZtDn1Etmfi0RFpvJr51FTzkzi9b64oUP863aTNayfR4AJw87dpy4uRD2M6B0vegFpFbOK8VE=
Authentication-Results: spf=pass (sender IP is 31.220.85.254)
smtp.mailfrom=sec4mail.de; dkim=pass (signature was verified)
header.d=sec4mail.de; dmarc=bestguesspass action=none header.from=sec4mail.de;
Received-SPF: Pass (protection.outlook.com: domain of sec4mail.de designates
31.220.85.254 as permitted sender) receiver=protection.outlook.com;
client-ip=31.220.85.254; helo=vmd109154.contaboserver.net; pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sec4mail.de;
s=default; t=1706252473;
bh=V7hQ6Qk152aR5GGd8cf8mW8c8NckOPB1WDcHCzVhoNc=;
h=Date:Subject:To:References:From:In-Reply-To:From;
b=eRAi/EOc/SkNsswiYjnyCiS91W9ldqF94B65PgEdmbhBtTyPFN/3ezEavFmnDss0G
85TyQEN+zbtY8jldhI+CscC/JFi0spKmYVJRFJbLIvp6EZ9mFxZWIS8WPbx6yc/TEi
OGNa/BKsHrOxk5sRSvRp9zdLxkOgL0zpDhbpK+tIOx2kU7ih4O8B4vAjnSTprFids0
nfMRtwY6IoMOMkpwPHqA4l3dUSVEl9PunOlFbqaizDgy7vY0gaKTpwL9i/AJM+Avat
GQsZGNtk5indVGZGf1IKLrd0TRtp0CIi/d3AlGlgC7VDRrAQK9feJ0WUVXqnjQo5FO
SWIf5KyX+nkPA==
Content-Language: en-US
In-Reply-To: <202401111441.40BEf6HH019591@hedwig.cmf.nrl.navy.mil>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB51:EE_|SA1PR01MB8088:EE_
X-MS-Office365-Filtering-Correlation-Id: fdc7b31a-ec7f-4ea2-0424-08dc1e3c95fa
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: P/jST1bhru2ib5xljAPHKYHCyqFbcmQEqYYxrlzcLJBv4rcxnF/xUU6fCaSArtHe/oXSWWov/oQIq7oxjicIzorV7vVq3gBtbFzjo4nHlaJbESFIhEMuFuKRbruFrd5aoabLIS6h1WM3uVSe+TT+v5aAxgTs6QJM9hSPLT2RWRmCVtUHRDglCrZbaGLRI8n08Wo3lRpRkcA0neE9ATs2efIvUxMMJvrQNP9muvC9p/7ZIRwPltIzegfojNdRFTdf1BJ9tlCxfvVCxJ+pTnxianxGR9VntvJOtHz6VrMFdJLrXnB16LicqX3fw6yIwBbJWKeTUAPnWM/IvB/JV7udsaI2sfAhfi6NI56w4piotUee6MvBzfAf53zqHTvtXMQEYbo9tk0OeT5CgZD6wdpUlU6qD30fS/S+FMwpP17Ln75VqP4uHSAAD5gsdOZtzicn35MDoqWw3y0Jr1CTfH8EzV43sgFPmYxY/5q8HATNKgfviC2T7PTocwOQdcdOoq2HomHBR7c1cGounCF3LMDjthHQoSOrnzcoduyBn3gZ9h99k9ycT22bPSHu4oMro+tDAnchlSFk2ARLr42vW05uypf8JTGpeH3x3SRC45c1KSRLEHmWVyEjoONAB5ASN+RdHGZ2aKlMaU7DTDjF5l5mBME+Vp3hkbek15BE5pYjc4y0bj9N92PoqanfkqN76pRYYqNRjpi9VBug435TX5rtnA==
X-Forefront-Antispam-Report: CIP:31.220.85.254; CTRY:DE; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:vmd109154.contaboserver.net; PTR:mail.goetz-golla.de;
CAT:NONE;
SFS:(13230031)(4636009)(39860400002)(346002)(376002)(396003)(136003)(64100799003)(451199024)(48200799006)(61400799012)(31686004)(786003)(86362001)(70586007)(68406010)(316002)(356005)(36756003)(6966003)(3480700007)(2906002)(81166007)(34206002)(5660300002)(8676002)(31696002)(83380400001)(336012)(6266002)(26005)(956004)(2616005)(498600001)(53546011)(43740500002);
DIR:OUT; SFP:1102;
X-ExternalRecipientOutboundConnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: mitprod.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2024 07:01:14.0641 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: fdc7b31a-ec7f-4ea2-0424-08dc1e3c95fa
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF0001AB51.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR01MB8088
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <81773b85-0be5-4412-9d64-ca94b2cdd2b7@sec4mail.de>
X-Mailman-Original-References: <8984fe41-f9a0-434b-a09c-df2bc88125dc@sec4mail.de>
<ae76ed5c-1399-401e-988c-ed2dbdfff6e7@mit.edu>
<81bc4460-b88a-4dfe-b538-e22805a086ea@sec4mail.de>
<202311191733.3AJHXASl018607@hedwig.cmf.nrl.navy.mil>
<414fe2a9-56ad-4401-b72a-4c002405e56c@sec4mail.de>
<202311242047.3AOKlYk3019409@hedwig.cmf.nrl.navy.mil>
<ffeca0f8-2646-4c63-88b2-e696f52bf24b@sec4mail.de>
<202401111441.40BEf6HH019591@hedwig.cmf.nrl.navy.mil>
 by: Goetz Golla - Fri, 26 Jan 2024 07:01 UTC

On 1/11/24 15:41, Ken Hornstein wrote:
> But here is some snippets of the PKCS#11 code in MIT Kerberos:
>
> When specifying the search parameters to find the private key:
>
> keytype = CKK_RSA;
> attrs[nattrs].type = CKA_KEY_TYPE;
> attrs[nattrs].pValue = &keytype;
> attrs[nattrs].ulValueLen = sizeof keytype;
> nattrs++;
>
> When setting the key signing mechanism:
>
> /*
> * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
> * historically many cards seem to be confused about whether they are
> * capable of mechanisms or not. The safe thing seems to be to ignore the
> * mechanism list, always use CKM_RSA_PKCS and calculate the sha256 digest
> * ourselves.
> */
> id_cryptoctx->mech = CKM_RSA_PKCS;
>
> Those are all hardcoded use of RSA keys and signing mechanisms and it
> doesn't handle ECC at all. So unless the Yubico library ignored the
> key type and mechanism (which I think would be extremely unlikely but
> not impossible) I suspect you were using RSA back during your original
> testing and didn't realize it.
>
> --Ken

Its good to know the reason why MIT Kerberos cannot handle EC
certificates right now.

I know that NIST is happy with RSA 2048, but in Europe RSA >= 3072 is
already mandatory, and this key size makes small devices like the
Yubikeys very slow when generating the keys. In fact, Yubikeys only
support RSA <=2048.

So is there a way to submit a feature request for ECDSA support in MIT
Kerberos ?

-- Goetz

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor