RFC 2942

Telnet Authentication: Kerberos Version 5

📅 published September 2000, from ietf

RFC 2942: Telnet Authentication: Kerberos Version 5 🎀

Part 1 of 2 💖

Okay bestie, here's the title block tea ☕ This is RFC 2942, called Telnet Authentication: Kerberos Version 5 🦋

  • Working group: Network Working Group
  • Author: T. Ts'o, from VA Linux Systems
  • Category: Standards Track
  • Date: September 2000
  • Obsoletes / Updates: The title block doesn't list anything it obsoletes or updates

Status of This Memo ✨

Okay so this doc is a Standards Track protocol spec for the whole Internet community, and it's literally asking everyone for discussion and suggestions 🫶 If you want the current standardization state of this protocol, go check the "Internet Official Protocol Standards" (STD 1), which is the source of truth. Distribution of this memo is unlimited, so share it with everyone 💅

Copyright (C) The Internet Society (2000). All Rights Reserved.

Abstract 🦋

So this RFC explains how Kerberos Version 5 [1] works with the telnet protocol 💜 It defines a telnet authentication suboption for the telnet authentication option [2]. This mechanism can also be used to give you keying material for data confidentiality services, working together with the telnet encryption option [3]. Iconic, honestly 👑

1. Command Names and Codes 💖

Here's the cheat sheet of every name and code you'll see 🍓

      Authentication Types

         KERBEROS_V5    2

      Sub-option Commands

         AUTH               0
         REJECT             1
         ACCEPT             2
         RESPONSE           3
         FORWARD            4
         FORWARD_ACCEPT     5
         FORWARD_REJECT     6

2. Command Meanings ✨

Now we get into what each message actually does, and this is the juicy part 🔥

First up is the big opener, AUTH 🦋 Its shape looks like this:

IAC SB AUTHENTICATION IS <authentication-type-pair> AUTH <Kerberos V5
KRB_AP_REQ message> IAC SE

This is how you pass the Kerberos V5 [1] KRB_AP_REQ message to the other side of the connection 🎀 The first octet of the <authentication-type-pair> value is KERBEROS_V5, which just says "yep, we're using Version 5 of Kerberos." The Kerberos V5 authenticator in the KRB_AP_REQ message MUST contain a Kerberos V5 checksum of the two-byte authentication type pair. The server MUST verify that checksum so we know the authentication type pair was negotiated correctly, no cap 💅

The Kerberos V5 authenticator MUST also include the optional subkey field, and that field SHALL be filled in with a randomly chosen key 🔑 That key SHALL be used for encryption if encryption got negotiated. It SHALL also be used as the negotiated session key (basically keyid 0) for the telnet encryption option. If the subkey isn't filled in, the ticket session key gets used instead, so it's giving backup plan 🧚

If you want data confidentiality, the ENCRYPT_USING_TELOPT flag MUST be set in the authentication-type-pair, as specified in [2] 🔐

Next is ACCEPT, the "we're good bestie" message 🌸

IAC SB AUTHENTICATION REPLY <authentication-type-pair> ACCEPT IAC SE

This one just tells you the authentication was successful 💖 If the AUTH_HOW_MUTUAL bit is set in the second octet of the authentication-type-pair, the RESPONSE command MUST be sent before the ACCEPT command is sent. Order matters here, periodt ⭐

Then there's REJECT, which is the "not today" message 💀

IAC SB AUTHENTICATION REPLY <authentication-type-pair> REJECT
<optional reason for rejection> IAC SE

This means the authentication was not successful 😭 If there's any more data left in the sub-option, it's an ASCII text message explaining why it got rejected. Spill the tea 🍵

Next is RESPONSE, which is for mutual authentication 🫶

IAC SB AUTHENTICATION REPLY <authentication-type-pair> RESPONSE
<KRB_AP_REP message> IAC SE

This command performs mutual authentication, so both sides prove who they are 👑 It's only used when the AUTH_HOW_MUTUAL bit is set in the second octet of the authentication-type-pair. After an AUTH command gets verified, a RESPONSE command goes out carrying a Kerberos V5 KRB_AP_REP message, and that's how the mutual auth happens 💜

Now FORWARD, the credentials glow-up ✨

IAC SB AUTHENTICATION <authentication-type-pair> FORWARD <KRB_CRED
message> IAC SE

This command forwards Kerberos credentials so they can be used by the remote session 🦋 The credentials get passed as a Kerberos V5 KRB_CRED message, which includes (among other things) the forwarded Kerberos ticket and a session key tied to that ticket. Part of the KRB_CRED message is encrypted with the key that was already exchanged for the telnet session through the AUTH suboption. Very secure, very main character 🔐

Then we have FORWARD_ACCEPT, the "forwarding worked" message 🌈

IAC SB AUTHENTICATION <authentication-type-pair> FORWARD_ACCEPT IAC
SE

This one just says the credential forwarding was successful 🎀

And last but not least, FORWARD_REJECT, the "forwarding did not work" message 🙈

IAC SB AUTHENTICATION <authentication-type-pair> FORWARD_REJECT
<optional reason for rejection> IAC SE

This means the credential forwarding was not successful. If there's more data in the suboption, it's an ASCII text message with the reason for the rejection 🍓

3. Implementation Rules 🧚

Okay this is where we get into the rules for who does what, and it's a little bit of a dance 💃

If the second octet of the authentication-type-pair has the AUTH_WHO bit set to AUTH_CLIENT_TO_SERVER, then the client sends the initial AUTH command, and the server responds with either ACCEPT or REJECT. Also, if the AUTH_HOW bit is set to AUTH_HOW_MUTUAL, the server will send a RESPONSE before it sends the ACCEPT 🦋

If the second octet of the authentication-type-pair has the AUTH_WHO bit set to AUTH_SERVER_TO_CLIENT, then the server sends the initial AUTH command, and the client responds with either ACCEPT or REJECT. Also, if the AUTH_HOW bit is set to AUTH_HOW_MUTUAL, the client will send a RESPONSE before it sends the ACCEPT 🔄

The Kerberos principal the server uses will generally look like host/<hostname>@realm 🔑 Breaking that down: the first component is "host", the second component is the fully qualified lower-case hostname of the server, and the realm is the Kerberos realm the server belongs to. Very organized, very iconic 💅

One more important rule 🚨 Any Telnet IAC characters that show up in the KRB_AP_REQ or KRB_AP_REP messages, the KRB_CRED structure, or the optional rejection text string MUST be doubled as specified in [4]. Otherwise the byte right after could get mis-interpreted as a Telnet command, and nobody wants that drama 😭

Part 2 is coming up next, with the examples, security considerations, IANA stuff, and references 🫶

okay so this part is the legal stuff, but bestie it's still giving main character energy 💅 ✨

Copyright (C) The Internet Society (2000). All Rights Reserved. 🎀

So basically, you're allowed to copy this doc and pass it around to your friends 🫶 and you can even make derivative works that comment on it, explain it, or help people implement it, and publish and distribute those too, in whole or in part, with no restriction at all 🌸. The one thing is that the copyright notice and this paragraph have to stay on every copy and derivative work 🔥.

However, this document itself may NOT be modified in any way 🙈. That means you can't remove the copyright notice or the references to the Internet Society or other Internet organizations, EXCEPT as needed for developing Internet standards (in which case you have to follow the copyright procedures in the Internet Standards process 📜), or if you need to translate it into a language other than English 🌈.

The limited permissions granted above are perpetual 💜 and will not be revoked by the Internet Society or its successors or assigns. Forever and ever, periodt 💀✨.

This document and the information contained herein is provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 😭 Translation: they're not promising it's perfect, so you use it at your own risk, no cap 🧚.

Acknowledgement 🌸

Funding for the RFC Editor function is currently provided by the Internet Society. 🫶 Shoutout to the Internet Society for keeping the RFC Editor function funded, you're a whole queen 👑💅.

📦 where this page comes from