Skip to content

SMB2Client: Update the security data during authentication - #360

Open
ErmolaevYura wants to merge 2 commits into
TalAloni:masterfrom
ErmolaevYura:master
Open

SMB2Client: Update the security data during authentication#360
ErmolaevYura wants to merge 2 commits into
TalAloni:masterfrom
ErmolaevYura:master

Conversation

@ErmolaevYura

Copy link
Copy Markdown

Hello TalAloni,
Thank you for working on this amazing library!

I found an issue related to implementing Kerberos signing and encryption, and I would like to suggest a small fix for it. I would be glad if I could help improve this library.

According to RFC 4120 (The Kerberos Network Authentication Service (V5)), Section 3.2.6 (Using the Encryption Key), page 34:
One way that an application may choose to negotiate a key to be used for subsequent integrity and privacy protection is for the client to propose a key in the subkey field of the authenticator. The server can then choose a key using the key proposed by the client as input, returning the new subkey in the subkey field of the application reply. This key could then be used for subsequent communication.

Therefore, the SMB2Client should send the security data back to the authenticator so that it can correctly generate a new session key.

@TalAloni

Copy link
Copy Markdown
Owner

Thanks. Will look into it when time permits.

@TalAloni

TalAloni commented Sep 5, 2026

Copy link
Copy Markdown
Owner

Thanks again, I'm seeing two changes here:

  1. NTLMAuthenticationClient - this seem to be specific to NTLM and not Kerberos - if it's an unrelated fix than it should be part of a different pull request
  2. SMB2Client: This change makes sense but how can I test that this change "works"? Which Kerberos implementation support this feature?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants