Is your feature request related to a problem? Please describe.
When using PKINIT on Linux, Kerberos.NET throws a PlatformNotSupportedException when attempting to create a Diffie-Hellman MODP-14 key agreement:
System.PlatformNotSupportedException: A crypto implementation of DH-MODP-14 does not exist for Unix
The exception originates from:
Kerberos.NET.Crypto.LinuxCryptoPal.DiffieHellmanModp14()
On Windows, DiffieHellmanModp14() is implemented using BCryptDiffieHellmanOakleyGroup14 / Windows CNG. However, the corresponding methods in LinuxCryptoPal are currently not implemented and throw PlatformNotSupportedException.
As a result, PKINIT scenarios that require DH MODP-14 cannot currently be used on Linux. This is particularly relevant for certificate-based Kerberos authentication scenarios where a service account authenticates using an X.509 certificate/PFX.
Describe the solution you'd like
Would it be possible to provide a cross-platform Unix implementation of DiffieHellmanModp14()? This could potentially be implemented using managed BigInteger.ModPow, OpenSSL, or another platform-independent/system cryptographic API.
Additional context
Environment:
- OS: Debian
- Kerberos.NET: 4.6.168
- KDC: Active Directory
- Authentication: PKINIT
- Certificate: X.509 certificate / PFX
Expected behavior:
PKINIT should be able to perform DH MODP-14 key agreement on Unix/Linux.
Actual behavior:
LinuxCryptoPal.DiffieHellmanModp14() throws PlatformNotSupportedException.
Is your feature request related to a problem? Please describe.
When using PKINIT on Linux, Kerberos.NET throws a PlatformNotSupportedException when attempting to create a Diffie-Hellman MODP-14 key agreement:
System.PlatformNotSupportedException: A crypto implementation of DH-MODP-14 does not exist for UnixThe exception originates from:
Kerberos.NET.Crypto.LinuxCryptoPal.DiffieHellmanModp14()On Windows, DiffieHellmanModp14() is implemented using BCryptDiffieHellmanOakleyGroup14 / Windows CNG. However, the corresponding methods in LinuxCryptoPal are currently not implemented and throw PlatformNotSupportedException.
As a result, PKINIT scenarios that require DH MODP-14 cannot currently be used on Linux. This is particularly relevant for certificate-based Kerberos authentication scenarios where a service account authenticates using an X.509 certificate/PFX.
Describe the solution you'd like
Would it be possible to provide a cross-platform Unix implementation of DiffieHellmanModp14()? This could potentially be implemented using managed BigInteger.ModPow, OpenSSL, or another platform-independent/system cryptographic API.
Additional context
Environment:
Expected behavior:
PKINIT should be able to perform DH MODP-14 key agreement on Unix/Linux.
Actual behavior:
LinuxCryptoPal.DiffieHellmanModp14() throws PlatformNotSupportedException.