Use P-256 for EC tests

Fedora/RedHat OpenSSL supports only P-256, P-384 and P-521.

The new mkcert.sh script can create updated certs when these
expire on Jan 17th 2038.
env KRB5CCNAME=/tmp/foocc kinit ignores the env

The problem is that fcc_get_cache_next() is called in a context where
context->default_cc_name is not set.  We should call
krb5_cc_default_name(), and that fixes the problem.  There's a comment
warning that this can result in reentering krb5_cc_cache_match(), but
nothing in libkrb5 calls krb5_cc_cache_match(), so the comment is wrong,
at least in the github tree.

An alternative would be to call krb5_cc_set_default_name(NULL) in
kuser/kinit.c before calling krb5_cc_cache_match(), however, that seems
like an insufficiently general solution.  Also, the semantics of
krb5_cc_cache_match() would differ from MIT's -- it seems better to
match MIT's semantics.
More complete logging of capths violations

It is much easier (i.e. actually possible) to debug transit path policy
violations when the logs specify the client and server realms, not just
the transit realm.
Add missing KRB-FX-CF2 test vectors (3DES broken)

Note that this shows that the our KRB-FX-CF2 is broken as to 3DES (and
the 1DES PRF is still missing).
Fix DES3 PRF

RFC 3961 says the simplified profile PRF should truncate the hash
output to "multiple of m", which MIT krb5 interprets as the largest
possible multiple of m.  RFC 6113 appendix A also uses that
interpretation for the KRB-FX-CF2 test vector.  So the DES3 PRF should
truncate the 20-byte SHA-1 result to 16 bytes, not 8.  Also make
krb5_crypto_prf_length work with DES3 by giving the DES3 enctype a
non-zero PRF length.

Signed-off-by: Nicolas Williams <nico@cryptonector.com>
Fix KRB-FX-CF2 for enctypes with non-dense keyspaces

It is necessary to use the RFC3961 random_to_key operation when
creating a key from a bitstring.

Signed-off-by: Nicolas Williams <nico@cryptonector.com>
don't see anything since /dev/random doesn't really need more seeding

redhat have Linux SE rules that slows down openssh when heimdal tries
to write, so lets not write.

https://bugzilla.redhat.com/show_bug.cgi?id=1076979