** Description changed:

  [ Impact ]
  
  Smartcard Authentication using Windows Server 2025 domain controllers fails 
with
  MIT Kerberos 1.20.1-6ubuntu2.6 in Noble with the following:
  
  ```
  [3577] 1782823607.222882: Received error from KDC: -1765328305/Checksum must 
be included
  kinit: Checksum must be included while getting initial credentials
  ```
  
  This may also impact Windows Server 2022 domain controllers in some
  configurations (upstream suggests "Computer Configuration > Policies
  > Administrative Templates > System > KDC
  > Configure hash algorithms for certificate logon").
  
  This bug was fixed upstream in [1]. Tests in [2] are included for basic
  unittest coverage of the changes.
  
  [1] 
https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
  [2] 
https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d
  
  [ Test Plan ]
  
  Attached is `setup.md` with a comprehensive guide for deploying Windows and
  configuring SSSD, AD & a Yubikey for certificate authentication.
  
  Verification should follow the guide for setup and use the following
  kinit:
  
  ```sh
  sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' 
[email protected]
  ```
  
  After prompting for the Yubikey pin:
  
  Expected result:
  
+ ```
+ $ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' 
[email protected]
+ Using default cache: /tmp/krb5cc_0
+ Using principal: [email protected]
+ PA Option X509_user_identity = PKCS11:
+ [7242] 1784670212.722461: Getting initial credentials for [email protected]
+ [7242] 1784670212.722463: Sending unauthenticated request
+ [7242] 1784670212.722464: Sending request (175 bytes) to TEST.SE
+ [7242] 1784670212.722465: Initiating TCP connection to stream 10.167.27.2:88
+ [7242] 1784670212.722466: Sending TCP request to stream 10.167.27.2:88
+ [7242] 1784670212.722467: Received answer (260 bytes) from stream 
10.167.27.2:88
+ [7242] 1784670212.722468: Terminating TCP connection to stream 10.167.27.2:88
+ [7242] 1784670212.722469: Response was from primary KDC
+ [7242] 1784670212.722470: Received error from KDC: -1765328359/Additional 
pre-authentication required
+ [7242] 1784670212.722473: Preauthenticating using KDC method data
+ [7242] 1784670212.722474: Processing preauth types: PA-PK-AS-REQ (16), 
PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2)
+ [7242] 1784670212.722475: Selected etype info: etype aes256-cts, salt 
"TEST.SEwesley", params ""
+ [7242] 1784670212.722476: PKINIT loading identity PKCS11:
+ [7242] 1784670212.722477: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
+ [7242] 1784670213.377619: PKINIT PKCS#11 slotid 0 token Users
+ [7242] 1784670213.377620: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
+ [7242] 1784670213.377621: PKINIT PKCS#11 slotid 0 token Users
+ Users                            PIN:
+ [7242] 1784670215.995742: PKINIT loading CA certs and CRLs from FILE 
/etc/sssd/pki/sssd_auth_ca_db.pem
+ [7242] 1784670215.995743: PKINIT client computed checksums: 
8A96F44C2975132F135DB71E35E713AA670A89DB 
711875D60BB33C317231A15BE7F72C9D8CA58175DD241131A181215C2B5F8CF2
+ [7242] 1784670215.995745: PKINIT client making DH request
+ [7242] 1784670216.003661: PKINIT chain cert #0: 
/DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger
+ [7242] 1784670216.003662: Preauth module pkinit (16) (real) returned: 
0/Success
+ [7242] 1784670216.003663: Produced preauth for next request: PA-PK-AS-REQ (16)
+ [7242] 1784670216.003664: Sending request (3456 bytes) to TEST.SE
+ [7242] 1784670216.003665: Initiating TCP connection to stream 10.167.27.2:88
+ [7242] 1784670216.003666: Sending TCP request to stream 10.167.27.2:88
+ [7242] 1784670216.003667: Received answer (4141 bytes) from stream 
10.167.27.2:88
+ [7242] 1784670216.003668: Terminating TCP connection to stream 10.167.27.2:88
+ [7242] 1784670216.003669: Response was from primary KDC
+ [7242] 1784670216.003670: Processing preauth types: PA-PK-AS-REP (17)
+ [7242] 1784670216.003671: PKINIT client verified DH reply
+ [7242] 1784670216.003672: PKINIT client config accepts KDC dNSName SAN 
win-64up1dm1tnf.test.se
+ [7242] 1784670216.003673: PKINIT client found 2 SANs (0 princs, 0 UPNs, 1 DNS 
names) in certificate /CN=WIN-64UP1DM1TNF.test.se
+ [7242] 1784670216.003674: PKINIT client found dNSName SAN in KDC cert: 
WIN-64UP1DM1TNF.test.se
+ [7242] 1784670216.003675: PKINIT client matched KDC hostname 
WIN-64UP1DM1TNF.test.se against dNSName SAN; EKU check still required
+ [7242] 1784670216.003676: PKINIT found acceptable EKU and digitalSignature KU
+ [7242] 1784670216.003677: PKINIT client found acceptable EKU in KDC cert
+ [7242] 1784670216.003678: PKINIT client used octetstring2key to compute reply 
key aes256-cts/6A78
+ [7242] 1784670216.003679: Preauth module pkinit (17) (real) returned: 
0/Success
+ [7242] 1784670216.003680: Produced preauth for next request: (empty)
+ [7242] 1784670216.003681: AS key determined by preauth: aes256-cts/6A78
+ [7242] 1784670216.003682: Decrypted AS reply; session key is: aes256-cts/A2C5
+ [7242] 1784670216.003683: FAST negotiation: unavailable
+ [7242] 1784670216.003684: Resolving unique ccache of type MEMORY
+ [7242] 1784670216.003685: Initializing MEMORY:lL326z9 with default princ 
[email protected]
+ [7242] 1784670216.003686: Storing config in MEMORY:lL326z9 for 
krbtgt/[email protected]: pa_type: 16
+ [7242] 1784670216.003687: Storing [email protected] -> 
krb5_ccache_conf_data/pa_type/krbtgt\/TEST.SE\@TEST.SE@X-CACHECONF: in 
MEMORY:lL326z9
+ [7242] 1784670216.003688: Storing config in MEMORY:lL326z9 for 
krbtgt/[email protected]: pa_config_data: {"X509_user_identity":"PKCS11:"}
+ [7242] 1784670216.003689: Storing [email protected] -> 
krb5_ccache_conf_data/pa_config_data/krbtgt\/TEST.SE\@TEST.SE@X-CACHECONF: in 
MEMORY:lL326z9
+ [7242] 1784670216.003690: Storing [email protected] -> krbtgt/[email protected] in 
MEMORY:lL326z9
+ [7242] 1784670216.003691: Moving ccache MEMORY:lL326z9 to FILE:/tmp/krb5cc_0
+ [7242] 1784670216.003692: Destroying ccache MEMORY:lL326z9
+ Authenticated to Kerberos v5
+ ```
  
  Actual result:
  
  ```
  $ sudo KRB5_TRACE=/dev/stderr kinit -V -X X509_user_identity='PKCS11:' 
[email protected]
  Using default cache: /tmp/krb5cc_0
  Using principal: [email protected]
  PA Option X509_user_identity = PKCS11:
  [4321] 1784645439.201446: Getting initial credentials for [email protected]
  [4321] 1784645439.201448: Sending unauthenticated request
  [4321] 1784645439.201449: Sending request (175 bytes) to TEST.SE
  [4321] 1784645439.201450: Initiating TCP connection to stream 10.167.27.2:88
  [4321] 1784645439.201451: Sending TCP request to stream 10.167.27.2:88
  [4321] 1784645439.201452: Received answer (260 bytes) from stream 
10.167.27.2:88
  [4321] 1784645439.201453: Terminating TCP connection to stream 10.167.27.2:88
  [4321] 1784645439.201454: Response was from primary KDC
  [4321] 1784645439.201455: Received error from KDC: -1765328359/Additional 
pre-authentication required
  [4321] 1784645439.201458: Preauthenticating using KDC method data
  [4321] 1784645439.201459: Processing preauth types: PA-PK-AS-REQ (16), 
PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), 111, PA-ENC-TIMESTAMP (2)
  [4321] 1784645439.201460: Selected etype info: etype aes256-cts, salt 
"TEST.SEwesley", params ""
  [4321] 1784645439.201461: PKINIT loading identity PKCS11:
  [4321] 1784645439.201462: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
  [4321] 1784645439.201463: PKINIT PKCS#11 slotid 0 token Users
  [4321] 1784645439.201464: PKINIT opening PKCS#11 module "opensc-pkcs11.so"
  [4321] 1784645440.099789: PKINIT PKCS#11 slotid 0 token Users
  Users                            PIN:
  [4321] 1784645442.770762: PKINIT loading CA certs and CRLs from FILE 
/etc/sssd/pki/sssd_auth_ca_db.pem
  [4321] 1784645442.770763: PKINIT client computed kdc-req-body checksum 
14/F6C7633376B8C2181CE9A7F18F12EE616118DC61
  [4321] 1784645442.770765: PKINIT client making DH request
  [4321] 1784645442.770766: PKINIT chain cert #0: 
/DC=se/DC=test/CN=Users/CN=Wesley D. Hershberger
  [4321] 1784645442.770767: Preauth module pkinit (16) (real) returned: 
0/Success
  [4321] 1784645442.770768: Produced preauth for next request: PA-PK-AS-REQ (16)
  [4321] 1784645442.770769: Sending request (3401 bytes) to TEST.SE
  [4321] 1784645442.770770: Initiating TCP connection to stream 10.167.27.2:88
  [4321] 1784645442.770771: Sending TCP request to stream 10.167.27.2:88
  [4321] 1784645443.004423: Received answer (86 bytes) from stream 
10.167.27.2:88
  [4321] 1784645443.004424: Terminating TCP connection to stream 10.167.27.2:88
  [4321] 1784645443.004425: Response was from primary KDC
  [4321] 1784645443.004426: Received error from KDC: -1765328305/Checksum must 
be included
  kinit: Checksum must be included while getting initial credentials
  ```
  
  [ Where problems could occur ]
  
  The ASN.1 sequence that is extended by the upstream fix (PKAuthenticator) is
  sent in the initial AS-REQ message sent by kinit when using PKINIT 
(certificate
  authentication). PKINIT is most common when using smartcards for 
authentication.
  Breakage as a result of this change would affect smartcard users.
  
  PKAuthenticator is specified as extensible in RFC-4556; it was assumed 
upstream
  that RFC-compliant implementations are able to decode PKAuthenticator even if
  they have not implemented support for PAChecksum2. It is expected that
  non-RFC-4556-compliant KDCs may be unable to decode the initial AS-REQ.
  
  If failures are encountered, verbose output for kinit should show failures
  while sending/receiving the messages modified by this change (PA-PK-AS-REQ,
  PA-PK-AS-REP). Use `KRB5_TRACE=/dev/stderr kinit -V`.
  
  As of July 20, 2026, the changes introduced by the patch have not been 
modified
  upstream, with the exception of 4c8ec1637 which fixes build issues on Solaris.
  
  [ Other information ]
  
  See the Microsoft spec for PA-PK-AS-REQ PAChecksum2 [1].
  
  Upstream commits [2][3].
  
  I explored the possibility of backporting this change to Ubuntu 22.04 but
  conflicts in expected test output make the backport significantly less trivial
  than for 24.04. Users with a hard dependency on Windows Server 2025 domain
  controllers should migrate to 24.04 or newer.
  
  [1] 
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pkca/8270b791-0201-4231-9d89-e5074459be2f
  [2] 
https://github.com/krb5/krb5/commit/310793ba63782af5ffa3a95d20e41f8f03ca7e00
  [3] 
https://github.com/krb5/krb5/commit/34d661676b1db04d870be3d7ad26616aa69d1f3d

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161440

Title:
  Smartcard auth with Windows Server 2025 fails with "Checksum must be
  included"

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2161440/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to