Path: csiph.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Newsgroups: comp.protocols.kerberos
Subject: Re: is there a way to detect if user is using same incorrect password in authentication
Date: Fri, 09 Aug 2024 21:03:01 -0400
Organization: TNet Consulting
Lines: 24
Message-ID: <mailman.122.1723251789.2322.kerberos@mit.edu>
References: <887838909.3164322.1723239377924.ref@mail.yahoo.com> <887838909.3164322.1723239377924@mail.yahoo.com> <202408100103.47A131bX008296@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50"; logging-data="6008"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
To: Jim Shi <hjshi@yahoo.com>
Received-SPF: Pass (protection.outlook.com: domain of cmf.nrl.navy.mil designates 140.32.59.234 as permitted sender) receiver=protection.outlook.com; client-ip=140.32.59.234; helo=mf.dren.mil; pr=C
In-Reply-To: <887838909.3164322.1723239377924@mail.yahoo.com>
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2024 01:03:03.4733 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 143ad553-a32d-42fc-2642-08dcb8d82fe6
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DS3PEPF000099D6.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR01MB6209
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>, <mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>, <mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <202408100103.47A131bX008296@hedwig.cmf.nrl.navy.mil>
X-Mailman-Original-References: <887838909.3164322.1723239377924.ref@mail.yahoo.com> <887838909.3164322.1723239377924@mail.yahoo.com>
Xref: csiph.com comp.protocols.kerberos:5351

>Hi, we have a required to detect  if a client is using same incorrect
>password in in authentication against KDC.  Is it possible the KDC
>server can determine if client is using same incorrect password?  Thanks

Ouch, is this some dang compliance requirement?  I thought I had dealt with
SO MANY weird compliance issues, but that's a new one to me.  I'm interested
in where this is coming from.  If I understand you, it seems like you mean
that a single client is repeating the same incorrect pasword over and over.
If you mean that different clients are trying to use the the same incorrect
password, I don't believe that's possible (nor do I understand why that
would be a requirement).  Upon further thought, this seems like a completely
ridiculous requirement and I cannot imagine why anyone would ask for it.

I _think_, in theory ... my first guess as to what you mean is possible.
But it won't be trivial.  I believe you could accomplish this by using
encryped timestamp preauth, detecting when a wrong password is seen,
remembering that on the KDC, and then sending the same encrypted timestamp
back to the client upon further password requests and detecting if the
response was the same.  That would be a lot of code and have issues if
the requests went to different KDCs.  It's very possible I could be wrong
about that.  And again, that only works with requests from the SAME client
due to password salting.

--Ken