Re: LDAP signing and encryption

Tech-Archive recommends: Speed Up your PC by fixing your registry

That makes sense since the KB articles also talk about what happens when the
admin tools use NTLM.

Thanks Joe.

Nick

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx> wrote
in message news:%237Xyz16RGHA.440@xxxxxxxxxxxxxxxxxxxxxxx
They are probably talking about Kerberos-based signing and sealing, not
SSL. Microsoft supports signing and sealing for RPC protocols that uses
SSPI for authentication. Since SSPI is supported for authentication with
LDAP, they probably just added the flags to enable this behavior.

You can also get signing/sealing behavior with SSL if you have deployed
certs to your DCs, but that is not a built in feature.

Joe K.

"NickvW" <me@xxxxxxxxxxx> wrote in message
news:%23DlrKY6RGHA.5468@xxxxxxxxxxxxxxxxxxxxxxx
I understand that the AD admin tools in Server 2003 sign and encrypt LDAP
traffic.

Do the tools negotiate an SSL session with the DC and if so where do the
certificates and private keys come from?

Will this work in a non PKI environment? If so, what signing and
encryption protocols are used?

Nick







.

Relevant Pages

  • Re: SSL, Apache 2 and RSA key sizes
    ... They will typically reuse the same RSA key-exchange key a lot, ... Why is it bad to use the same RSA key for both encryption and signing? ... especially in the early SSL versions. ...
    (sci.crypt)
  • Re: Authentication Cookie subject to spoofing/sniffing attacks?
    ... > It's recommended that when signing on using FormsAuthentication, ... if I only use SSL to protect the SignIn page but not ... > the other pages (which require authorization), ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: LDAP signing and encryption
    ... They are probably talking about Kerberos-based signing and sealing, not SSL. ... Since SSPI is supported for authentication with LDAP, ...
    (microsoft.public.windows.server.active_directory)
  • Authentication Cookie subject to spoofing/sniffing attacks?
    ... It's recommended that when signing on using FormsAuthentication, ... If I understand FormsAuthentication mechanism correctly, ... ticket generated is then appended to every single page requests that need to ... if I only use SSL to protect the SignIn page but not ...
    (microsoft.public.dotnet.framework.aspnet)