On Thu, Mar 6, 2025 at 10:26 PM Jim Shi via Kerberos <[email protected]> wrote:
> Hi, is there easy way to check if AS-REP is valid or not?that is, is there > is tool or stand alone program to check? > I don't know about an existing tool but in theory an AS-REP is pretty self-contained which makes it "easy" relatively speaking. You just need the base key (like from a keytab) to decrypt it and thus validate it. But you would need a kerberos lib to help because it needs to generate a so-called DK key or derived key which is a non-trivial bit of code. Meaning it's not as simple as running it through AES-whatever. There is a nonce generated in the AS-REQ that's supposed to be checked but if you're just validating an AS-REQ I think it would be ok to ignore it since it's primary purpose is to mix-up the ciphertext so that the KDC can detect a replay and you're not a KDC. Knowing this, in theory you could probably make a tool in a 100 lines of python assuming there's a decent python kerberos lib out there. Mike -- Michael B Allen Java AD DS Integration https://www.ioplex.com/ <http://www.ioplex.com/> ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
