Bug 2357215

Summary:	PKINIT: implement paChecksum2 from MS-PKCA v20230920 [fedora]
Product:	[Fedora] Fedora	Reporter:	Julien Rische <jrische>
Component:	krb5	Assignee:	Julien Rische <jrische>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	abokovoy, antorres, ftrivino, jrische, j, sbose, ssorce
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	krb5-1.21.3-6.fc43 krb5-1.21.3-5.fc41	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-06-06 14:17:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Julien Rische 2025-04-03 14:53:40 UTC

We noticed that PKINIT stopped working with AD 2025. MS DocHelp informed us[1] this is caused by the absence of the paChecksum2 element in the PKINIT AS-REQ. MS-PKCA was updated[2] with this element.

Support of the new paChecksum2 sequence was merged upstream for Wireshark[3] and MIT krb5[4].

[1] https://lists.samba.org/archive/cifs-protocol/2025-January/004417.html
[2] https://winprotocoldoc.z19.web.core.windows.net/MS-PKCA/%5bMS-PKCA%5d-230920-diff.pdf
[3] https://gitlab.com/wireshark/wireshark/-/merge_requests/18834
[4] https://github.com/krb5/krb5/pull/1411

Reproducible: Always

Comment 1 Fedora Update System 2025-06-06 12:54:17 UTC

FEDORA-2025-1c915db8a5 (krb5-1.21.3-6.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-1c915db8a5

Comment 2 Fedora Update System 2025-06-06 14:17:01 UTC

FEDORA-2025-1c915db8a5 (krb5-1.21.3-6.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 3 Fedora Update System 2025-06-06 15:10:07 UTC

FEDORA-2025-3de9fe91ff (krb5-1.21.3-6.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-3de9fe91ff

Comment 4 Fedora Update System 2025-06-06 15:12:30 UTC

FEDORA-2025-42a13f896e (krb5-1.21.3-5.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-42a13f896e

Comment 5 Fedora Update System 2025-06-07 07:11:02 UTC

FEDORA-2025-42a13f896e has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-42a13f896e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-42a13f896e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2025-06-07 08:25:50 UTC

FEDORA-2025-3de9fe91ff has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-3de9fe91ff`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-3de9fe91ff

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-06-09 02:35:11 UTC

FEDORA-2025-3de9fe91ff (krb5-1.21.3-6.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2025-06-10 02:59:13 UTC

FEDORA-2025-42a13f896e (krb5-1.21.3-5.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.