RFC 2712
Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)
RFC 2712: Addition of Kerberos Cipher Suites to Transport Layer Security (TLS) 🎀
The deets (title block, bestie):
- RFC number: 2712
- Title: Addition of Kerberos Cipher Suites to Transport Layer Security (TLS)
- Authors: Ari Medvinsky (Excite) and Matthew Hur (CyberSafe Corporation) 👯
- Category: Standards Track
- Date: October 1999
- Obsoletes / Updates: The header doesn't list any RFCs this one obsoletes or updates 🙅♀️
- Working group: Network Working Group
Status of this Memo 📜
okay so this bit says this doc specifies an Internet standards track protocol for the Internet community, and it's basically asking everyone for discussion and suggestions for improvements 🫶. For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). And distribution of this memo is unlimited, so share it with everyone 💖.
Copyright Notice ©️
Copyright (C) The Internet Society (1999). All Rights Reserved. Boring but important 💅.
IESG Note 🚨
Heads up, this one is serious: The 40-bit ciphersuites defined in this memo are only included to document the fact that those ciphersuite codes have already been assigned. 40-bit ciphersuites were designed to comply with US-centric, and now obsolete, export restrictions. They were never secure, and nowadays they're inadequate even for casual applications. Implementation and use of the 40-bit ciphersuites defined in this document, and elsewhere, is strongly discouraged 💀.
1. Abstract ✨
this doc proposes adding new cipher suites to the TLS protocol [1] so it can do Kerberos-based authentication 🔐. Kerberos credentials get used for mutual authentication, and they also set up a master secret, which then secures the client-server communication from there on out 🦋.
2. Introduction 🌸
okay so the best thing about TLS is how flexible it is 💖. Clients and servers can negotiate cipher suites to match their own security and admin policies. The catch is that, so far, TLS authentication only works with public key solutions 😭. That means TLS doesn't fully support orgs with mixed security setups that include authentication systems based on symmetric cryptography, which is a real gap.
Kerberos was originally developed at MIT. It's built on an open standard [2], and it's the most widely deployed symmetric key authentication system out there 👑. So this doc proposes a new option for negotiating Kerberos authentication inside the TLS framework. It gets mutual authentication and establishes a master secret using Kerberos credentials, and the changes needed are minimal. Honestly, it's no different from adding a new public key algorithm to TLS, which is iconic 🧚.
3. Kerberos Authentication Option In TLS 🎀
this section walks through adding the Kerberos authentication option to TLS 💅. Throughout the doc, we keep coming back to the basic SSL handshake in Figure 1. If you want a refresher on the TLS handshake, see [1].
CLIENT SERVER
------ ------
ClientHello
-------------------------------->
ServerHello
Certificate *
ServerKeyExchange*
CertificateRequest*
ServerHelloDone
<-------------------------------
Certificate*
ClientKeyExchange
CertificateVerify*
change cipher spec
Finished
| -------------------------------->
| change cipher spec
| Finished
| |
| |
Application Data <------------------------------->Application Data
FIGURE 1: The TLS protocol. All messages followed by a star are
optional. Note: This figure was taken from an IETF document
[1].The TLS security context gets negotiated in the client and server hello messages 🤝. For example, TLS_RSA_WITH_RC4_MD5 means the initial authentication is done with the RSA public key algorithm, RC4 handles the session key, and MACs are based on MD5 🔑. So to make the Kerberos authentication option happen, we have to start by defining new cipher suites. The list includes (but isn't limited to) these:
CipherSuite TLS_KRB5_WITH_DES_CBC_SHA = { 0x00,0x1E };
CipherSuite TLS_KRB5_WITH_3DES_EDE_CBC_SHA = { 0x00,0x1F };
CipherSuite TLS_KRB5_WITH_RC4_128_SHA = { 0x00,0x20 };
CipherSuite TLS_KRB5_WITH_IDEA_CBC_SHA = { 0x00,0x21 };
CipherSuite TLS_KRB5_WITH_DES_CBC_MD5 = { 0x00,0x22 };
CipherSuite TLS_KRB5_WITH_3DES_EDE_CBC_MD5 = { 0x00,0x23 };
CipherSuite TLS_KRB5_WITH_RC4_128_MD5 = { 0x00,0x24 };
CipherSuite TLS_KRB5_WITH_IDEA_CBC_MD5 = { 0x00,0x25 };
CipherSuite TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA = { 0x00,0x26 };
CipherSuite TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA = { 0x00,0x27 };
CipherSuite TLS_KRB5_EXPORT_WITH_RC4_40_SHA = { 0x00,0x28 };
CipherSuite TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 = { 0x00,0x29 };
CipherSuite TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 = { 0x00,0x2A };
CipherSuite TLS_KRB5_EXPORT_WITH_RC4_40_MD5 = { 0x00,0x2B };To set up a Kerberos-based security context, one or more of the cipher suites above must be specified in the client hello message 🙌. If the TLS server supports the Kerberos authentication option, its server hello message back to the client confirms the Kerberos cipher suite the server picked 🎉.
Here's the fun part. The server's certificate, the CertificateRequest, and the ServerKeyExchange from Figure 1 all get left out, because authentication and master secret setup happen using the client's Kerberos credentials for the TLS server ✨. The client's certificate gets left out for the same reason 🙈. These messages are optional in the TLS protocol, so skipping them is totally permissible 💖.
The Kerberos option must be added to the ClientKeyExchange message, like Figure 2 shows 🎀.
struct
{
select (KeyExchangeAlgorithm)
{
case krb5: KerberosWrapper; /* new addition */
case rsa: EncryptedPreMasterSecret;
case diffie_hellman: ClientDiffieHellmanPublic;
} Exchange_keys;
} ClientKeyExchange;
struct
{
opaque Ticket;
opaque authenticator; /* optional */
opaque EncryptedPreMasterSecret; /* encrypted with the session key
which is sealed in the ticket */
} KerberosWrapper; /* new addition */
FIGURE 2: The Kerberos option in the ClientKeyExchange.To use the Kerberos authentication option, the TLS client must obtain a service ticket for the TLS server 🎫. In TLS, the ClientKeyExchange message is what passes a random 48-byte pre-master secret over to the server 🔐.
Next, the client and server each use the pre-master secret to independently derive the master secret 🧠. The master secret then gets used to generate session keys and for MAC computations. So if the Kerberos option gets selected, the pre-master secret structure is the same one used in the RSA case. It's encrypted under the Kerberos session key and sent to the TLS server along with the Kerberos credentials (check Figure 2) 💅. The ticket and authenticator are encoded per RFC 1510 (ASN.1 encoding) 📦. Once the server gets the ClientKeyExchange message, it uses its secret key to unwrap the credentials and pull out the pre-master secret 🔓.
Authenticator tea: A Kerberos authenticator is not required. The master secret that the client and server derive is seeded with a random value passed in the server hello message, and that's what foils replay attacks 🙅♀️. Still, the authenticator may prove useful for passing authorization information, so it gets its own optional field (see Figure 2) 🍓.
Lastly, the client and server exchange finished messages to wrap up the handshake 🎀. At this point, the following has been achieved:
- A master secret, used to protect all subsequent communication, is securely established 🔐.
- Mutual client-server authentication is achieved, since the TLS server proves knowledge of the master secret in the finished message 🤝.
And the Kerberos option fits in seamlessly without adding any new messages. Literally no new messages, which is so iconic 👑✨.
Part 1 ends here, bestie. Part 2 picks up with Section 4 (Naming Conventions) and the rest of the doc 🦋👀.
10. Full Copyright Statement ✨
Okay bestie, this is the legal section, so I'm keeping it tight and accurate 💅. Copyright (C) The Internet Society (1999). All Rights Reserved. 🎀
So here's the deal: this document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind 🦋. The one catch is that the above copyright notice and this paragraph have to be included on all such copies and derivative works 🫶. However, this document itself may not be modified in any way 🙈, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. The only exceptions are if you need it for developing Internet standards, in which case the procedures for copyrights defined in the Internet Standards process must be followed, or if you need to translate it into languages other than English 🌈.
The limited permissions granted above are perpetual 💜 and will not be revoked by the Internet Society or its successors or assigns. Forever and ever, periodt 💀.
This document and the information contained herein is provided on an "AS IS" basis 🍓, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 😭. Yikes, but that's the legal vibe.
Acknowledgement 🌸
Funding for the RFC Editor function is currently provided by the Internet Society 🧚. Thank you to them for keeping the lights on, iykyk ✨.
📦 where this page comes from
- ietf: rfc2712 1999-10
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms