OSF DCE Application Development Guide--Core Components

DCE Security Service
Figure 23-9. Peer Applications Establish a Security Context
i.pI ../security/figures/2_authn_80.ps 0 0 1
1. The context initiator uses the gss_init_sec_context routine to request a ticket
from the DCE Security Server that will allow the initiator to talk to the context
acceptor.
The initiator’s Security Runtime creates an envelope that contains:
• The initiator’s PTGT
• The acceptor’s principal name
• A time stamp encrypted under the third conversation key
The Security Runtime sends the envelope to the Authentication Service. The
Authentication Service does the following:
• Decrypts the PTGT to get the third conversation key (see Section 23.2.1.2).
• Checks the time encrypted under the third conversation key:
— If the time doesn’t match, the authentication fails, and the Authentication
Service returns a failure message to the Security Runtime, which in turn
sends a message to the GSSAPI.
— If the time matches, the initiator’s identity is authenticated, and the
Authentication Service creates a ticket to allow the initiator to
authenticate itself to the acceptor.
The ticket consists of the following:
• A seal of an EPAC(s) which accompanies (that is, not contained within) the
ticket.
• A fourth conversation key, generated by the Authentication Service
The Authentication Service then encrypts the ticket under the acceptor’s secret
key. It sends the ticket (encrypted under the acceptor’s secret key) and the
fourth conversation key (encrypted under the third conversation key) to the
initiator’s Security Runtime.
2. The initiator’s Security runtime:
• Decrypts the fourth conversation key
• Encrypts the current time under the fourth conversation key
• Sends the following to GSSAPI:
— The ticket
— The EPAC(s)
— The encrypted time stamp
— The fourth conversation key
3. GSSAPI holds onto the fourth conversation key and creates a GSSAPI token
containing:
23−24 Tandem Computers Incorporated 124245