pull up r24538 from trunk

pull up r24538 from trunk

 ------------------------------------------------------------------------
 r24538 | ghudson | 2010-11-30 16:20:49 -0500 (Tue, 30 Nov 2010) | 27 lines

 ticket: 6827
 subject: SA-2010-007 Checksum vulnerabilities (CVE-2010-1324 and others)

 Fix multiple checksum handling bugs, as described in:
   CVE-2010-1324
   CVE-2010-1323
   CVE-2010-4020
   CVE-2010-4021

 * Return the correct (keyed) checksums as the mandatory checksum type
   for DES enctypes.
 * Restrict simplified-profile checksums to their corresponding etypes.
 * Add internal checks to reduce the risk of stream ciphers being used
   with simplified-profile key derivation or other algorithms relying
   on the block encryption primitive.
 * Use the mandatory checksum type for the PKINIT KDC signature,
   instead of the first-listed keyed checksum.
 * Use the mandatory checksum type when sending KRB-SAFE messages by
   default, instead of the first-listed keyed checksum.
 * Use the mandatory checksum type for the t_kperf test program.
 * Use the mandatory checksum type (without additional logic) for the
   FAST request checksum.
 * Preserve the existing checksum choices (unkeyed checksums for DES
   enctypes) for the authenticator checksum, using explicit logic.
 * Ensure that SAM checksums received from the KDC are keyed.
 * Ensure that PAC checksums are keyed.

ticket: 6827
version_fixed: 1.9
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24540 dc483132-0cff-0310-8789-dd5450dbe970