A Generalized Framework for Kerberos Pre-Authentication (RFC6113)
Original Publication Date: 2011-Apr-01
Included in the Prior Art Database: 2011-Apr-22
Internet Society Requests For Comment (RFCs)
S. Hartman: AUTHOR [+1]
The core Kerberos specification [RFC4120] treats pre-authentication data (padata) as an opaque typed hole in the messages to the key distribution center (KDC) that may influence the reply key used to encrypt the KDC reply. This generality has been useful: pre- authentication data is used for a variety of extensions to the protocol, many outside the expectations of the initial designers. However, this generality makes designing more common types of pre- authentication mechanisms difficult. Each mechanism needs to specify how it interacts with other mechanisms. Also, tasks such as combining a key with the long-term secrets or proving the identity of the user are common to multiple mechanisms. Where there are generally well-accepted solutions to these problems, it is desirable to standardize one of these solutions so mechanisms can avoid duplication of work. In other cases, a modular approach to these problems is appropriate. The modular approach will allow new and better solutions to common pre-authentication problems to be used by existing mechanisms as they are developed.
Internet Engineering Task Force (IETF) S. Hartman Request for Comments: 6113 Painless Security Updates: 4120 L. Zhu Category: Standards Track Microsoft Corporation ISSN: 2070-1721 April 2011
A Generalized Framework for Kerberos Pre-Authentication
Kerberos is a protocol for verifying the identity of principals (e.g., a workstation user or a network server) on an open network. The Kerberos protocol provides a facility called pre-authentication. Pre-authentication mechanisms can use this facility to extend the Kerberos protocol and prove the identity of a principal.
This document describes a more formal model for this facility. The model describes what state in the Kerberos request a pre- authentication mechanism is likely to change. It also describes how multiple pre-authentication mechanisms used in the same request will interact.
This document also provides common tools needed by multiple pre- authentication mechanisms. One of these tools is a secure channel between the client and the key distribution center with a reply key strengthening mechanism; this secure channel can be used to protect the authentication exchange and thus eliminate offline dictionary attacks. With these tools, it is relatively straightforward to chain multiple authentication mechanisms, utilize a different key management system, or support a new key agreement algorithm.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6113.
Hartman & Zhu Standards Track [Page 1]
RFC 6113 Kerberos Preauth Framework April 2011
Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publ...