From: Greg Hudson <ghudson@mit.edu>
Date: Tue, 12 Jan 2010 01:07:48 +0000 (+0000)
Subject: Use keyed checksum type for DES FAST
X-Git-Tag: krb5-1.9-beta1~381
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=da9d96e6f471b38cd31931132629be9a44db056b;p=krb5.git

Use keyed checksum type for DES FAST

DES enctypes have unkeyed mandatory-to-implement checksums.  Since
FAST requires a keyed checksum, we must pick something else in that
case.

ticket: 6633
target_version: 1.7
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23629 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 48199815a..db95adca7 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -238,6 +238,9 @@ krb5int_fast_prep_req(krb5_context context,
     if (retval == 0)
         retval = krb5int_c_mandatory_cksumtype(context, state->armor_key->enctype,
                                                &cksumtype);
+    /* DES enctypes have unkeyed mandatory checksums; need a keyed one. */
+    if (retval == 0 && !krb5_c_is_keyed_cksum(cksumtype))
+        cksumtype = CKSUMTYPE_RSA_MD5_DES;
     if (retval ==0)
         retval = krb5_c_make_checksum(context, cksumtype, state->armor_key,
                                       KRB5_KEYUSAGE_FAST_REQ_CHKSUM, to_be_checksummed,