0

I am currently working on kerberos, and for now have this doubt on PAC in MS-KILE kerberos extension.

Can pac be included in pactype structure within authorization data, is meant for client to decrypt and decode.

It seems (if my understanding is correct), that PAC is encrypted with target server's encryption key, which is known only to kdc and target server, and therefore, client just needs to forward that to server when requesting a service, and isn't supposed to decrypt and extract details about its credentails.

Is there a way to try to decrypt this on the fly? ( is there sufficient information available in AS-REP for me extract and decrypt this?

Michael Foukarakis
  • 39,737
  • 6
  • 87
  • 123
Varun
  • 85
  • 1
  • 6

1 Answers1

0

Your understanding is correct. PAC is encrypted by the target server's encryption key, which is known only to KDC and target server. Therefore, the client cannot decrypt and extract details about its credentials. That's to make sure nobody can modify the content inside PAC.

Harvey Kwok
  • 11,713
  • 6
  • 37
  • 59