dotnet / dotnet/Kerberos.NET

Add support for RFC 5349 "Elliptic Curve PKINIT"

Open
#105 2 comments 1 reaction 0 assignees View on GitHub
enhancement Kerberos.NET up-for-grabs
Dominant language
C#
Stars
567
Forks
109
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
The base PKINIT spec supports straight Diffie Hellman using MODP 2 or 14 parameters. This is inefficient and leads to potential interop problems. ECC support was spec'ed shortly after PKINIT and introduces ECDH for key exchange and certificate signatures. This will have better performance implications as well as better cross-platform support as ECDH is supported in .NET Core.

**Describe the solution you'd like**
Introduce logic into `AsymmetricKerberosCredential` that detects if the client certificate is EC, and force everything into using EC.

Add a new property to the credential that indicates the key exchange should prefer ECDH over DH (should it be default?).

**Additional context**
https://tools.ietf.org/html/rfc5349

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.