<div dir="ltr">Thanks Obaid for clarifying this, it answered the question for me.<div><br></div><div>Regards.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, May 20, 2019 at 7:18 AM Obaid Farooqi <<a href="mailto:obaidf@microsoft.com">obaidf@microsoft.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Isaac:<br>
Thanks for pointing this to us. As you noted, PA-FOR-USER is only signed (and not encrypted). I have filed a bug to fix this issue.<br>
<br>
Please let me know if this does not answer your question.<br>
Also feel free to ask if you have any other question.<br>
<br>
Regards,<br>
Obaid Farooqi<br>
Escalation Engineer | Microsoft<br>
<br>
-----Original Message-----<br>
From: Obaid Farooqi <br>
Sent: Wednesday, May 15, 2019 11:52 AM<br>
To: Isaac Boukris <<a href="mailto:iboukris@gmail.com" target="_blank">iboukris@gmail.com</a>><br>
Cc: <a href="mailto:cifs-protocol@lists.samba.org" target="_blank">cifs-protocol@lists.samba.org</a>; Uri Simchoni <<a href="mailto:uri@samba.org" target="_blank">uri@samba.org</a>>; Andrew Bartlett <<a href="mailto:abartlet@samba.org" target="_blank">abartlet@samba.org</a>>; support <<a href="mailto:support@mail.support.microsoft.com" target="_blank">support@mail.support.microsoft.com</a>><br>
Subject: RE: [MS-SFU] Clarification about the ASN1 definition of PA_FOR_USER ASN1<br>
<br>
Hi Isaac:<br>
I'll help you with this issue and will be in touch as soon as I have an answer.<br>
<br>
Regards,<br>
Obaid Farooqi<br>
Escalation Engineer | Microsoft<br>
<br>
Exceeding your expectations is my highest priority. If you would like to provide feedback on your case you may contact my manager at ramagane at Microsoft dot com<br>
<br>
-----Original Message-----<br>
From: Jeff McCashland <<a href="mailto:jeffm@microsoft.com" target="_blank">jeffm@microsoft.com</a>> <br>
Sent: Wednesday, May 15, 2019 10:47 AM<br>
To: Isaac Boukris <<a href="mailto:iboukris@gmail.com" target="_blank">iboukris@gmail.com</a>><br>
Cc: <a href="mailto:cifs-protocol@lists.samba.org" target="_blank">cifs-protocol@lists.samba.org</a>; Uri Simchoni <<a href="mailto:uri@samba.org" target="_blank">uri@samba.org</a>>; Andrew Bartlett <<a href="mailto:abartlet@samba.org" target="_blank">abartlet@samba.org</a>>; support <<a href="mailto:support@mail.support.microsoft.com" target="_blank">support@mail.support.microsoft.com</a>><br>
Subject: RE: [MS-SFU] Clarification about the ASN1 definition of PA_FOR_USER ASN1<br>
<br>
[DocHelp to BCC, support on CC, SR ID on Subject]<br>
<br>
Hi Issac,<br>
<br>
Thank you for your question. on Kerberos. We have created SR ID 119051523001903 to track this issue. One of our protocols engineers will respond soon.<br>
<br>
Best regards,<br>
Jeff McCashland | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team<br>
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada) Local country phone number found here: <a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsupport.microsoft.com%2Fglobalenglish&data=01%7C01%7Cobaidf%40microsoft.com%7C72ef701121944a8894de08d6d94c868c%7C72f988bf86f141af91ab2d7cd011db47%7C1&sdata=2BSsu7o0ZHHwpYGhCgxg40wSXC%2F8IGe%2FcohWjpNMgng%3D&reserved=0" rel="noreferrer" target="_blank">https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsupport.microsoft.com%2Fglobalenglish&data=01%7C01%7Cobaidf%40microsoft.com%7C72ef701121944a8894de08d6d94c868c%7C72f988bf86f141af91ab2d7cd011db47%7C1&sdata=2BSsu7o0ZHHwpYGhCgxg40wSXC%2F8IGe%2FcohWjpNMgng%3D&reserved=0</a> | Extension 1138300 We value your feedback. My manager is Jeremy Chapman (jeremyc), +1 (469) 775-2475<br>
<br>
-----Original Message-----<br>
From: Isaac Boukris <<a href="mailto:iboukris@gmail.com" target="_blank">iboukris@gmail.com</a>><br>
Sent: Wednesday, May 15, 2019 7:38 AM<br>
To: Interoperability Documentation Help <<a href="mailto:dochelp@microsoft.com" target="_blank">dochelp@microsoft.com</a>><br>
Cc: <a href="mailto:cifs-protocol@lists.samba.org" target="_blank">cifs-protocol@lists.samba.org</a>; Uri Simchoni <<a href="mailto:uri@samba.org" target="_blank">uri@samba.org</a>>; Andrew Bartlett <<a href="mailto:abartlet@samba.org" target="_blank">abartlet@samba.org</a>><br>
Subject: [MS-SFU] Clarification about the ASN1 definition of PA_FOR_USER ASN1<br>
<br>
Hello dochelp,<br>
<br>
According to MS-SFU 2.2.1, the ASN1 definition of PA-FOR-USER is as follows:<br>
<br>
padata-type ::= PA-FOR-USER<br>
-- value 129<br>
padata-value ::= EncryptedData<br>
-- PA-FOR-USER-ENC<br>
<br>
PA-FOR-USER-ENC ::= SEQUENCE {<br>
userName[0] PrincipalName,<br>
userRealm[1] Realm,<br>
cksum[2] Checksum,<br>
auth-package[3] KerberosString<br>
}<br>
<br>
This makes it sounds as if the padata content gets encrypted (EncryptedData), but as far as I know, no implementation - including Windows - encrypts this padata, and it is only protected by the checksum. Can you please clarify?<br>
<br>
Thanks,<br>
Isaac<br>
</blockquote></div>