dotnet / dotnet/Kerberos.NET

Diffie-Hellman MODP-14 is not implemented on Linux/Unix, preventing PKINIT from working

Open
#433 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
567
Forks
109
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**

When using PKINIT on Linux, Kerberos.NET throws a PlatformNotSupportedException when attempting to create a Diffie-Hellman MODP-14 key agreement:
`System.PlatformNotSupportedException:
A crypto implementation of DH-MODP-14 does not exist for Unix`
The exception originates from:
`Kerberos.NET.Crypto.LinuxCryptoPal.DiffieHellmanModp14()`

On Windows, DiffieHellmanModp14() is implemented using BCryptDiffieHellmanOakleyGroup14 / Windows CNG. However, the corresponding methods in LinuxCryptoPal are currently not implemented and throw PlatformNotSupportedException.

As a result, PKINIT scenarios that require DH MODP-14 cannot currently be used on Linux. This is particularly relevant for certificate-based Kerberos authentication scenarios where a service account authenticates using an X.509 certificate/PFX.

**Describe the solution you'd like**
Would it be possible to provide a cross-platform Unix implementation of DiffieHellmanModp14()? This could potentially be implemented using managed BigInteger.ModPow, OpenSSL, or another platform-independent/system cryptographic API.

**Additional context**
Environment:
- OS: Debian
- Kerberos.NET: 4.6.168
- KDC: Active Directory
- Authentication: PKINIT
- Certificate: X.509 certificate / PFX

Expected behavior:
PKINIT should be able to perform DH MODP-14 key agreement on Unix/Linux.

Actual behavior:
LinuxCryptoPal.DiffieHellmanModp14() throws PlatformNotSupportedException.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.