From 5ce504c1fb24f341c3084b53338166c81bd41341 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Thu, 15 Dec 2011 16:17:09 +1100 Subject: [PATCH] use ETYPE_DES3_CBC_SHA1 for the verify step in verify_mic_des3 This allows a strict link between checksum types and key types to be enforced. Andrew Bartlett Signed-off-by: Love Hornquist Astrand --- lib/gssapi/krb5/verify_mic.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/gssapi/krb5/verify_mic.c b/lib/gssapi/krb5/verify_mic.c index af06e0a1e..0f5612491 100644 --- a/lib/gssapi/krb5/verify_mic.c +++ b/lib/gssapi/krb5/verify_mic.c @@ -251,6 +251,14 @@ retry: csum.checksum.length = 20; csum.checksum.data = p + 8; + krb5_crypto_destroy (context, crypto); + ret = krb5_crypto_init(context, key, + ETYPE_DES3_CBC_SHA1, &crypto); + if (ret){ + *minor_status = ret; + return GSS_S_FAILURE; + } + ret = krb5_verify_checksum (context, crypto, KRB5_KU_USAGE_SIGN, tmp, message_buffer->length + 8,