[cifs-protocol] MS-NRPC: AES Schannel problems

[Stefan (metze) Metzmacher]

Hi,

I'm currently trying to implement the AES based Netlogon Secure Channel
in Samba.

But the documentation is not really clear about the used algorithms.

I have started with the implementation here:
http://gitweb.samba.org/?p=metze/samba/wip.git;a=shortlog;h=refs/heads/master4-schannel

And here's the actual commit that tries to add aes support:
http://gitweb.samba.org/?p=metze/samba/wip.git;a=commitdiff;h=50dca9ce0f051c863f00cc949db2c19bf247887b

In Section "3.1.4.3 Session-Key Computation" the hmac-sha256 base
computation of the session-key seems to use the plain SharedSecret
and not the NT-HASH of it (MD4(UNICODE(ShareSecret))), is that correct?
I thought the plain text is never stored in AD by default...
Where should the netlogon server get the plain text from?
I just tried the NT-HASH see my netlogon_creds_init_hmac_sha256() function.

In Section "3.1.4.4 Netlogon Credential Computation" there's a
AesEncrypt function used. Can you please document the exact algorithm
that's used there. You say AES128 is used in CFB mode without
initialization vector.

http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation
says that all modes except ECB require an IV.

It would also be nice if you could add some more example values
in secion 4.2 Cryptographic Values for Session Key Validation.

metze




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/cifs-protocol/attachments/20090825/32b5c140/attachment.pgp>