sqlmapproject/sqlmap · error · KerberosError

KDC advertised an out-of-policy string-to-key iteration coun

Error message

KDC advertised an out-of-policy string-to-key iteration count (%d)

What it means

Error "KDC advertised an out-of-policy string-to-key iteration count (%d)" thrown in sqlmapproject/sqlmap.

Source

Thrown at extra/kerberos/client.py:211

    return hints

def _preauthHints(errorFields):
    """The etype hints carried by a KDC_ERR_PREAUTH_REQUIRED error's e-data (best effort)."""

    if 12 not in errorFields:                              # no e-data
        return {}
    try:
        return _etypeHints(der.peel(errorFields[12])[1])   # e-data OCTET STRING -> METHOD-DATA
    except (KeyError, IndexError, ValueError, struct.error):
        return {}

def _validatedIterations(iterations):
    """Refuse a string-to-key work factor outside local policy. The hint is unauthenticated, so a
    spoofed count could either cheapen an offline attack on the PA-ENC-TIMESTAMP we are about to send
    or stall the scan for hours; failing loudly beats doing either silently."""

    if iterations is not None and not MIN_PBKDF2_ITERATIONS <= iterations <= MAX_PBKDF2_ITERATIONS:
        raise KerberosError(-1, "KDC advertised an out-of-policy string-to-key iteration count (%d)" % iterations)
    return iterations

def _hintFor(hints, etype, salt, chosenSalt):
    """Apply the hint for 'etype': its salt (unless the caller pinned one) and its work factor."""

    advertisedSalt, iterations = hints.get(etype, (None, None))
    if salt is None and advertisedSalt is not None:
        chosenSalt = advertisedSalt
    return chosenSalt, _validatedIterations(iterations)

def _replyEtype(response):
    """Return the etype of a KDC-REP's enc-part (which etype the KDC used for the client's key)."""

    try:
        rep = _fields(der.peel(der.peel(response)[1])[1])
        return _expInteger(_expFields(rep[6])[0])
    except (KeyError, IndexError, ValueError, struct.error):
        raise KerberosError(-1, "malformed KDC reply")

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at extra/kerberos/client.py:211 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/60299452b1e04786. Report an issue: GitHub.