Jul 5, 2023 · Nov 2, 2023 · Nov 2, 2023 · Nov 29, 2023 · Nov 29, 2023
diff --git a/kdc/pkinit.c b/kdc/pkinit.c
    size -= dh_gen_keylen;
    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
    memset(dh_gen_key, 0, size);
    dh_gen_keylen += size;
 }
    } else if (client_params->keyex == USE_ECDH) {
 if (client_params->u.ecdh.public_key == NULL) {
diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
    size -= dh_gen_keylen;
    memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
    memset(dh_gen_key, 0, size);
    dh_gen_keylen += size;
 }

    } else {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -230,6 +230,7 @@ generate_dh_keyblock(krb5_context context,
		size -= dh_gen_keylen;
		memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
		memset(dh_gen_key, 0, size);
		dh_gen_keylen += size;
Copy link Member abartletNov 2, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Does the buggy client mean we need to try both possibilities now? Copy link ContributorAuthor jsutton24Nov 2, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Yes, if we want to interoperate with buggy Heimdal clients without sporadic failures. For the other way round, interoperating with buggy Heimdal servers, the client probably would need to keep regenerating the key until it got a working one. Copy link Member jaltmanNov 29, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Back in 2010 there were interop problems with MIT which resulted in the submission of both`7639f83` and then`6e05462`. Does the existing code successfully interoperate with MIT? Copy link ContributorAuthor jsutton24Nov 29, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Does the existing code successfully interoperate with MIT? I don’t know. I haven’t tested that.
		}
		} else if (client_params->keyex == USE_ECDH) {
		if (client_params->u.ecdh.public_key == NULL) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1493,6 +1493,7 @@ pk_rd_pa_reply_dh(krb5_context context,
		size -= dh_gen_keylen;
		memmove(dh_gen_key + size, dh_gen_key, dh_gen_keylen);
		memset(dh_gen_key, 0, size);
		dh_gen_keylen += size;
		}

		} else {
Expand Down