Home/ Questions/Q 7695199
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T21:29:39+00:00

I am currently working on kerberos, and for now have this doubt on PAC

  • 0

I am currently working on kerberos, and for now have this doubt on PAC in MS-KILE kerberos extension.

Can pac be included in pactype structure within authorization data, is meant for client to decrypt and decode.

It seems (if my understanding is correct), that PAC is encrypted with target server’s encryption key, which is known only to kdc and target server, and therefore, client just needs to forward that to server when requesting a service, and isn’t supposed to decrypt and extract details about its credentails.

Is there a way to try to decrypt this on the fly? ( is there sufficient information available in AS-REP for me extract and decrypt this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Your understanding is correct. PAC is encrypted by the target server’s encryption key, which is known only to KDC and target server. Therefore, the client cannot decrypt and extract details about its credentials. That’s to make sure nobody can modify the content inside PAC.

    • 0