{"record":{"id":"60299452b1e04786","repo":"sqlmapproject/sqlmap","slug":"kdc-advertised-an-out-of-policy-string-to-key-iter","errorCode":null,"errorMessage":"KDC advertised an out-of-policy string-to-key iteration count (%d)","messagePattern":"KDC advertised an out-of-policy string-to-key iteration count \\((.+?)\\)","errorType":"exception","errorClass":"KerberosError","httpStatus":null,"severity":"error","filePath":"extra/kerberos/client.py","lineNumber":211,"sourceCode":"    return hints\n\ndef _preauthHints(errorFields):\n    \"\"\"The etype hints carried by a KDC_ERR_PREAUTH_REQUIRED error's e-data (best effort).\"\"\"\n\n    if 12 not in errorFields:                              # no e-data\n        return {}\n    try:\n        return _etypeHints(der.peel(errorFields[12])[1])   # e-data OCTET STRING -> METHOD-DATA\n    except (KeyError, IndexError, ValueError, struct.error):\n        return {}\n\ndef _validatedIterations(iterations):\n    \"\"\"Refuse a string-to-key work factor outside local policy. The hint is unauthenticated, so a\n    spoofed count could either cheapen an offline attack on the PA-ENC-TIMESTAMP we are about to send\n    or stall the scan for hours; failing loudly beats doing either silently.\"\"\"\n\n    if iterations is not None and not MIN_PBKDF2_ITERATIONS <= iterations <= MAX_PBKDF2_ITERATIONS:\n        raise KerberosError(-1, \"KDC advertised an out-of-policy string-to-key iteration count (%d)\" % iterations)\n    return iterations\n\ndef _hintFor(hints, etype, salt, chosenSalt):\n    \"\"\"Apply the hint for 'etype': its salt (unless the caller pinned one) and its work factor.\"\"\"\n\n    advertisedSalt, iterations = hints.get(etype, (None, None))\n    if salt is None and advertisedSalt is not None:\n        chosenSalt = advertisedSalt\n    return chosenSalt, _validatedIterations(iterations)\n\ndef _replyEtype(response):\n    \"\"\"Return the etype of a KDC-REP's enc-part (which etype the KDC used for the client's key).\"\"\"\n\n    try:\n        rep = _fields(der.peel(der.peel(response)[1])[1])\n        return _expInteger(_expFields(rep[6])[0])\n    except (KeyError, IndexError, ValueError, struct.error):\n        raise KerberosError(-1, \"malformed KDC reply\")","sourceCodeStart":193,"sourceCodeEnd":229,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/extra/kerberos/client.py#L193-L229","documentation":"Error \"KDC advertised an out-of-policy string-to-key iteration count (%d)\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at extra/kerberos/client.py:211 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}