From 1787efaa006b73cd682f6c27f2b5d367495e7e02 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Thu, 15 Dec 2011 16:17:09 +1100 Subject: use ETYPE_DES3_CBC_SHA1 for the verify step in verify_mic_des3 This allows a strict link between checksum types and key types to be enforced. Andrew Bartlett --- source4/heimdal/lib/gssapi/krb5/verify_mic.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'source4/heimdal') diff --git a/source4/heimdal/lib/gssapi/krb5/verify_mic.c b/source4/heimdal/lib/gssapi/krb5/verify_mic.c index af06e0a1e3..0f5612491d 100644 --- a/source4/heimdal/lib/gssapi/krb5/verify_mic.c +++ b/source4/heimdal/lib/gssapi/krb5/verify_mic.c @@ -251,6 +251,14 @@ retry: csum.checksum.length = 20; csum.checksum.data = p + 8; + krb5_crypto_destroy (context, crypto); + ret = krb5_crypto_init(context, key, + ETYPE_DES3_CBC_SHA1, &crypto); + if (ret){ + *minor_status = ret; + return GSS_S_FAILURE; + } + ret = krb5_verify_checksum (context, crypto, KRB5_KU_USAGE_SIGN, tmp, message_buffer->length + 8, -- cgit