Subject: Re: [kitten] Non-Password Password Change

From: Nico Williams <[email-masked]>
Date: Wed, 9 Dec 2015 03:50:22 -0600

On Thu, Oct 15, 2015 at 05:51:50PM -0400, Greg Hudson wrote:
> On 10/15/2015 03:59 PM, Henry B (Hank) Hotz, CISSP wrote:
> > There’s been work on improved password change protocols, but I’m not sure how much actually completed. I also remember once suggesting that loading a KDB entry from a keytab file would be useful, at least for handling cross-realm principals.
> 
> I believe the most recent work is:
> 
>     https://tools.ietf.org/html/draft-ietf-krb-wg-kerberos-set-passwd-08
> 
> I vaguely recall an explicit decision not to continue with that work
> because no one believed they were likely to implement it.

Yes.

> > Are there any password change protocols where you can supply the enctype and a key instead of a text password?
> 
> This is probably obvious, but any such facility allows the client to
> circumvent password policies, and therefore usually require special
> permissions.

Roland Dowdeswell's krb5_admin has a method for setting principal keys
with a multi-party DH exchange where the KDC is one of the parties.
This works *very* well.  I strongly recommend it.  https://github.com/elric1/

Nico
--