Just try all the keys

Trying to find the right key by name is error prone and often leads to issues. It's more effective to try all keys of the given etype since it's still bound by the total length of keys in the table.

Author: SteveSyfuhs

Kerberos.NET/Crypto/DecryptedKrbApReq.cs

@@ -4,6 +4,9 @@
 // -----------------------------------------------------------------------
 
 using System;
+using System.Linq;
+using System.Security;
+using System.Security.Cryptography;
 using Kerberos.NET.Entities;
 
 namespace Kerberos.NET.Crypto
@@ -65,9 +68,38 @@ public override void Decrypt(KeyTable keytab)
                 throw new ArgumentNullException(nameof(keytab));
             }
 
-            var key = keytab.GetKey(this.EType, this.SName);
+            var keys = keytab.GetKeys(this.EType, this.SName);
 
-            this.Decrypt(key);
+            if (!keys.Any())
+            {
+                throw new InvalidOperationException($"Could not find a key for {this.EType} and {this.SName.FullyQualifiedName}");
+            }
+
+            Exception ex = null;
+
+            foreach (var key in keys)
+            {
+                try
+                {
+                    this.Decrypt(key);
+                    return;
+                }
+                catch (CryptographicException cex)
+                {
+                    ex = cex;
+                    continue;
+                }
+                catch (SecurityException secx)
+                {
+                    ex = secx;
+                    continue;
+                }
+            }
+
+            if (ex != null)
+            {
+                throw ex;
+            }
         }
 
         public override void Decrypt(KerberosKey ticketEncryptingKey)

Kerberos.NET/Crypto/KeyTable.cs

@@ -74,28 +74,44 @@ public void Write(BinaryWriter writer)
 
         private ICollection<KeyEntry> entries;
 
-        public ICollection<KeyEntry> Entries => this.entries ?? (this.entries = new List<KeyEntry>());
+        public ICollection<KeyEntry> Entries => this.entries ??= new List<KeyEntry>();
 
         public KerberosKey GetKey(ChecksumType type, KrbPrincipalName sname)
         {
-            EncryptionType etype;
+            var etype = type switch
+            {
+                ChecksumType.HMAC_SHA1_96_AES128 => EncryptionType.AES128_CTS_HMAC_SHA1_96,
+                ChecksumType.HMAC_SHA1_96_AES256 => EncryptionType.AES256_CTS_HMAC_SHA1_96,
+                _ => EncryptionType.RC4_HMAC_NT,
+            };
+            return this.GetKey(etype, sname);
+        }
+
+        public IEnumerable<KerberosKey> GetKeys(EncryptionType type, KrbPrincipalName sname)
+        {
+            // try and find a matching entry
+
+            var entries = this.Entries
+                .Where(e => e.EncryptionType == type && (sname?.Matches(e.Principal) ?? true))
+                .OrderByDescending(x => x.Version);
+
+            if (!entries.Any())
+            {
+                // Fall back to first entry with matching type
 
-            switch (type)
+                entries = this.Entries
+                    .Where(e => e.EncryptionType == type)
+                    .OrderByDescending(x => x.Version);
+            }
+
+            if (!entries.Any())
             {
-                case ChecksumType.HMAC_SHA1_96_AES128:
-                    etype = EncryptionType.AES128_CTS_HMAC_SHA1_96;
-                    break;
-                case ChecksumType.HMAC_SHA1_96_AES256:
-                    etype = EncryptionType.AES256_CTS_HMAC_SHA1_96;
-                    break;
-
-                case ChecksumType.KERB_CHECKSUM_HMAC_MD5:
-                default:
-                    etype = EncryptionType.RC4_HMAC_NT;
-                    break;
+                // fall back to first entry
+
+                entries = this.Entries.OrderByDescending(x => x.Version);
             }
 
-            return this.GetKey(etype, sname);
+            return entries.Select(e => e.Key);
         }
 
         public KerberosKey GetKey(EncryptionType type, KrbPrincipalName sname)
@@ -107,22 +123,16 @@ public KerberosKey GetKey(EncryptionType type, KrbPrincipalName sname)
                 .OrderByDescending(x => x.Version)
                 .FirstOrDefault();
 
-            // Fall back to first entry with matching type (RC4_HMAC_NT)
+            // Fall back to first entry with matching type
 
-            if (entry == null)
-            {
-                entry = this.Entries
+            entry ??= this.Entries
                     .Where(e => e.EncryptionType == type)
                     .OrderByDescending(x => x.Version)
                     .FirstOrDefault();
-            }
 
             // Fall back to first entry
 
-            if (entry == null)
-            {
-                entry = this.Entries.FirstOrDefault();
-            }
+            entry ??= this.Entries.FirstOrDefault();
 
             return entry?.Key;
         }