question Re: question about keytab content in Archives of Support Questions (Read Only)

question about keytab content

ddv36a78 — Fri, 16 Sep 2022 13:19:49 GMT

Hi,

I have not yet kerberized my Hadoop cluster yet. But, I am wondering about keytab (content).

Originally, I thought a keytab entry is just 1..to..N couples (principal name, secret key unencrypted).

But, recently, while trying to validate that point of view, I have read, here for example, that the secret key is stored encrypted. So, it means then that there should be somewhere a master key to store the keytab's secret in an encrypted form.

So, my (simple) questions:

- How a secret key is stored inside a keytab ? raw (uncrypted) ? encrypted ?

- If stored encrypted, what is the master key to crypt keytab's secret ?

Thanks.

Re: question about keytab content

Shelton — Mon, 11 Jun 2018 16:57:53 GMT

@Dominique De Vito

When creating the KDC server the database holds the Master key

The keytab contains pairs of Kerberos principals and keys in the encrypted form
The Keytab is authenticated the against the Master key in KDC server which is generated using kdb5_util

HTH

Re: question about keytab content

ddv36a78 — Mon, 18 Jun 2018 21:51:57 GMT

Geoffrey Shelton Okot

Thanks for your answer.

Unfortunately for me, it leads to more (inner) questions 😉

1) While the client/Kerberos dialogs are well-described with a non-encrypted secret key for the client (described in Wikipedia), I have not found yet a description explaining how parties agree to work together, when the client side has only an encrypted secret key in a keytab.

2) I don't see why things are improved after encrypting the secret key in a keytab. AFAIU one identity could be stolen when copying a keytab, and then, in that case, having, inside the keytab, a secret key, encrypted or not, does not look like to change anything related to keytab copy protection.

Some things are still obscure for me.

About (1) : do you have any link pointing to a protocol detail description when working with an encrypted secret key in a keytab ?

Thanks again.