Browse Prior Art Database

A Generalized Framework for Kerberos Pre-Authentication (RFC6113)

IP.com Disclosure Number: IPCOM000206383D
Original Publication Date: 2011-Apr-01
Included in the Prior Art Database: 2011-Apr-22

Publishing Venue

Internet Society Requests For Comment (RFCs)

Related People

S. Hartman: AUTHOR [+2]

Abstract

The core Kerberos specification [RFC4120] treats pre-authentication data (padata) as an opaque typed hole in the messages to the key distribution center (KDC) that may influence the reply key used to encrypt the KDC reply. This generality has been useful: pre- authentication data is used for a variety of extensions to the protocol, many outside the expectations of the initial designers. However, this generality makes designing more common types of pre- authentication mechanisms difficult. Each mechanism needs to specify how it interacts with other mechanisms. Also, tasks such as combining a key with the long-term secrets or proving the identity of the user are common to multiple mechanisms. Where there are generally well-accepted solutions to these problems, it is desirable to standardize one of these solutions so mechanisms can avoid duplication of work. In other cases, a modular approach to these problems is appropriate. The modular approach will allow new and better solutions to common pre-authentication problems to be used by existing mechanisms as they are developed.

This text was extracted from an ASCII text file.
This is the abbreviated version, containing approximately 2% of the total text.

Internet Engineering Task Force (IETF)                        S. Hartman Request for Comments: 6113                             Painless Security Updates: 4120                                                     L. Zhu Category: Standards Track                          Microsoft Corporation ISSN: 2070-1721                                               April 2011

         A Generalized Framework for Kerberos Pre-Authentication

Abstract

   Kerberos is a protocol for verifying the identity of principals    (e.g., a workstation user or a network server) on an open network.    The Kerberos protocol provides a facility called pre-authentication.    Pre-authentication mechanisms can use this facility to extend the    Kerberos protocol and prove the identity of a principal.

   This document describes a more formal model for this facility.  The    model describes what state in the Kerberos request a pre-    authentication mechanism is likely to change.  It also describes how    multiple pre-authentication mechanisms used in the same request will    interact.

   This document also provides common tools needed by multiple pre-    authentication mechanisms.  One of these tools is a secure channel    between the client and the key distribution center with a reply key    strengthening mechanism; this secure channel can be used to protect    the authentication exchange and thus eliminate offline dictionary    attacks.  With these tools, it is relatively straightforward to chain    multiple authentication mechanisms, utilize a different key    management system, or support a new key agreement algorithm.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force    (IETF).  It represents the consensus of the IETF community.  It has    received public review and has been approved for publication by the    Internet Engineering Steering Group (IESG).  Further information on    Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,    and how to provide feedback on it may be obtained at    http://www.rfc-editor.org/info/rfc6113.

 Hartman & Zhu                Standards Track                    [Page 1]
 RFC 6113               Kerberos Preauth Framework             April 2011

 Copyright Notice

   Copyright (c) 2011 IETF Trust and the persons identified as the    document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal    Provisions Relating to IETF Documents    (http://trustee.ietf.org/license-info) in effect on the date of    publ...