kerb: fix subkey in PA-FOR-USER

scapy/layers/kerberos.py

@@ -954,8 +954,7 @@ class LSAP_TOKEN_INFO_INTEGRITY(Packet):
             },
         ),
         MayEnd(XStrFixedLenField("MachineID", b"", length=32)),
-        # KB 5068222 - still waiting for [MS-KILE] update (oct. 2025)
-        XStrFixedLenField("PermanentMachineID", b"", length=32),
+        XStrFixedLenField("CrossBootMachineID", b"", length=32),
     ]
 
 
@@ -4038,6 +4037,8 @@ def tgs_req(self):
                     cksumtype=ChecksumType.RSA_MD4,
                 )
             else:
+                # Use subkey if available (=subkey), else TGT session key (=key).
+                # NB: undocumented right now -- gpo2
                 pasfux509.checksum.make(
                     self.subkey or self.key,
                     bytes(pasfux509.userId),
@@ -4065,8 +4066,9 @@ def tgs_req(self):
                         + paforuser.authPackage.val
                     ).encode()
                 )
+                # Always use TGT session key (=key)
                 paforuser.cksum.make(
-                    self.subkey or self.key,
+                    self.key,
                     S4UByteArray,
                     cksumtype=ChecksumType.HMAC_MD5,
                 )
@@ -5687,7 +5689,7 @@ def GSS_Init_sec_context(
                                             adData=KERB_AD_RESTRICTION_ENTRY(
                                                 restriction=LSAP_TOKEN_INFO_INTEGRITY(
                                                     MachineID=bytes(RandBin(32)),
-                                                    PermanentMachineID=bytes(
+                                                    CrossBootMachineID=bytes(
                                                         RandBin(32)
                                                     ),
                                                 )

scapy/layers/ntlm.py

@@ -655,9 +655,8 @@ class Single_Host_Data(Packet):
             },
         ),
         XStrFixedLenField("MachineID", b"", length=32),
-        # KB 5068222 - still waiting for [MS-KILE] update (oct. 2025)
         ConditionalField(
-            XStrFixedLenField("PermanentMachineID", None, length=32),
+            XStrFixedLenField("CrossBootMachineID", None, length=32),
             lambda pkt: pkt.Size is None or pkt.Size > 48,
         ),
     ]
@@ -1726,7 +1725,7 @@ def GSS_Init_sec_context(
                         AvId="MsvAvSingleHost",
                         Value=Single_Host_Data(
                             MachineID=os.urandom(32),
-                            PermanentMachineID=os.urandom(32),
+                            CrossBootMachineID=os.urandom(32),
                         ),
                     ),
                 ]

scapy/layers/spnego.py

@@ -242,7 +242,7 @@ class SPNEGO_negTokenResp(ASN1_Packet):
         ASN1F_optional(
             ASN1F_PACKET("mechListMIC", None, SPNEGO_MechListMIC, explicit_tag=0xA3)
         ),
-        # [MS-SPNG] Late Fallback Mechanism
+        # [MS-SPNG] sect 2.2.2 - Late Fallback Mechanism
         ASN1F_optional(
             ASN1F_SEQUENCE_OF("mechTypes", None, SPNEGO_MechType, explicit_tag=0xA4)
         ),
@@ -1012,7 +1012,7 @@ def from_cli_arguments(
         # Build the SSP
         return cls(ssps)
 
-    # [MS-SPNG] Late Fallback Mechanism
+    # [MS-SPNG] 3.1.5.1 - Late Fallback Mechanism
     _LATE_FALLBACK_INITIATOR = ASN1_OID("0.0.99.99.99.99.99.99.99.99")
     _LATE_FALLBACK_ACCEPTOR = ASN1_OID("0.0.115.115.115.115.115.115.115.115")