DSSync encryption notes
abartlet at samba.org
Fri Dec 23 00:09:29 GMT 2005
I just wanted to put some observations to the list about the encryptped
blobs in the DRSUAPI replication.
Firstly, this is the command I've been running:
bin/smbtorture ncacn_ip_tcp:win2k3dc.win2k3.abartlet.net RPC-DSSYNC
This particular setup ensures that the base encryption keys for NTLMSSP
remain constant, which is an important for the crypt-analysis of this
Interestingly, the output (in terms of encrypted blobs) varies between
runs. I also note that attributes appear 20 bytes longer than I would
have expected. My suspicion is that each value is encrypted with the
hash of a 16 or 20 byte 'confounder' and the session key, much like the
I'm yet to figure out what algorithms are used for the hash, but I
strongly suspect that the actual data encryption is RC4 (due to
irregular length data blobs, which discount a block cipher).
At some point I'll write up a 'challenge' to narrow this down further.
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Student Network Administrator, Hawker College http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20051223/d6d8f6af/attachment.bin
More information about the samba-technical