🚀 go-pugleaf

    
    The timestamp field in a V5 keytab entry appears to be the time it was
    extracted from the database, rather than the time the key was last
    changed (useful) or that the principal was created (slightly less
    useful).  Can someone explain why this decision was made?
    
    Barry Jaspan
    Aktis, Inc.
    
The timestamp field in the V5 keytab entry is the time the entry was
added to the keytable.  The DCE added this feature for a number of reasons - the
most direct was to know which key is the newest in the keytable.  Since
key version numbers wrap at 255, the version number is not enough.  In our
environment the time the key was written to the key table is effectively the
same time it is set in the KDC (we abstract access to the kerberos environment
and the facility that manages keys for servers operates on both databases -
making a direct change to the keytable and then a remote change to the KDC.)

                    -- Joe Pato
                       Distributed Computing Program / East
                       Hewlett-Packard Company
                       pato@apollo.hp.com


-------