Diffie-Hellman MODP-14 is not implemented on Linux/Unix, preventing PKINIT from working
- Dominant language
- C#
- Stars
- 567
- Forks
- 109
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
When using PKINIT on Linux, Kerberos.NET throws a PlatformNotSupportedException when attempting to create a Diffie-Hellman MODP-14 key agreement:
`System.PlatformNotSupportedException:
A crypto implementation of DH-MODP-14 does not exist for Unix`
The exception originates from:
`Kerberos.NET.Crypto.LinuxCryptoPal.DiffieHellmanModp14()`
On Windows, DiffieHellmanModp14() is implemented using BCryptDiffieHellmanOakleyGroup14 / Windows CNG. However, the corresponding methods in LinuxCryptoPal are currently not implemented and throw PlatformNotSupportedException.
As a result, PKINIT scenarios that require DH MODP-14 cannot currently be used on Linux. This is particularly relevant for certificate-based Kerberos authentication scenarios where a service account authenticates using an X.509 certificate/PFX.
**Describe the solution you'd like**
Would it be possible to provide a cross-platform Unix implementation of DiffieHellmanModp14()? This could potentially be implemented using managed BigInteger.ModPow, OpenSSL, or another platform-independent/system cryptographic API.
**Additional context**
Environment:
- OS: Debian
- Kerberos.NET: 4.6.168
- KDC: Active Directory
- Authentication: PKINIT
- Certificate: X.509 certificate / PFX
Expected behavior:
PKINIT should be able to perform DH MODP-14 key agreement on Unix/Linux.
Actual behavior:
LinuxCryptoPal.DiffieHellmanModp14() throws PlatformNotSupportedException.
Contributor guide
Assessment
This issue has not been assessed yet.