RFC 4537

Kerberos Cryptosystem Negotiation Extension

📅 published June 2006, from ietf

RFC 4537: Kerberos Cryptosystem Negotiation Extension ✨

okay bestie, this one is all about Kerberos 🎀 and it's a Standards Track doc from the Network Working Group, published in June 2006 📅. It updates RFC 4120 🔥 (it doesn't list anything it obsoletes). The authors are Larry Zhu, Paul Leach, and Karthik Jaganathan, all from Microsoft Corporation 💜.

Status of This Memo 🌸

so this doc is an Internet standards track protocol for the Internet community, and the authors are literally asking for discussion and suggestions for improvements 🙈. If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. Distribution of this memo is unlimited 🦋.

Copyright (C) The Internet Society (2006).

Abstract ✨

okay so this extends Kerberos as defined in RFC 4120 🧚. The client can send a list of supported encryption types in decreasing preference order, and then the server picks an encryption type that both the client and the server support. Iconic 👑.

Table of Contents 🍓

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Conventions Used in This Document . . . . . . . . . . . . . . . 2
3.  Negotiation Extension . . . . . . . . . . . . . . . . . . . . . 2
4.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
5.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 4
6.  Normative References  . . . . . . . . . . . . . . . . . . . . . 4

1. Introduction 🌈

so under the current mechanism [RFC4120], the Kerberos Distribution Center (KDC) has to limit the ticket session key encryption type (enctype) it picks for a given server to one it thinks both the client and the server support 😭. The problem is that if both the client and server understand a stronger enctype than the one the KDC picked, they literally cannot negotiate it 💀. So the protection of application traffic ends up weaker than it needs to be, especially when the server can support different sets of enctypes depending on which server application software is running 🙅‍♀️.

This document adds an extension to Kerberos so clients and servers can negotiate a different, and possibly stronger, cryptosystem for later communication 💖.

The extension uses an authorization data element in the authenticator of the AP-REQ message [RFC4120] 🔥. The client sends the list of enctypes it supports to the server, and then the server tells the client which one it chose 🫶. The negotiated subkey is sent in the AP-REP message [RFC4120] ✨.

2. Conventions Used in This Document 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📚.

3. Negotiation Extension 💜

okay this is the main event, so pay attention 👀. If the client likes an enctype more than the service ticket session key, then it SHOULD send the server a list of enctypes in decreasing preference order 💅. The client picks which enctypes go on that list from everything available locally, based on local policy 🌸. It SHOULD NOT include enctypes that are less preferable than the enctype of the ticket session key in the service ticket 🙈. Also, the client SHOULD NOT include negative (local-use) enctype numbers unless it knows ahead of time that the server has been configured to use the same negative enctype numbers for the same enctypes 🔥.

The client sends the enctype list through the authorization-data of the authenticator in the AP-REQ [RFC4120] 🧚. A new authorization data element type, AD-ETYPE-NEGOTIATION, is defined 🦋:

        AD-ETYPE-NEGOTIATION              129

This authorization data element is wrapped in the AD-IF-RELEVANT container, so a correctly implemented server that doesn't understand this element should ignore it [RFC4120] 🫶. The value of this authorization element is the DER [X680] [X690] encoding of the following ASN.1 type 🤓:

        EtypeList ::= SEQUENCE OF Int32
           -- Specifies the enctypes supported by the client.
           -- This enctype list is in decreasing preference order
           -- (favorite choice first).
           -- Int32 is defined in [RFC4120].

If the EtypeList is present and the server prefers an enctype from the client's list over the AP-REQ authenticator subkey (if that's present) or the service ticket session key, then the server MUST create a subkey using that enctype 🔥. This negotiated subkey gets sent in the subkey field of the AP-REP message, and then it's used as the protocol key or base key [RFC3961] for later communication 👑.

If the enctype of the ticket session key is included in the enctype list the client sent, it SHOULD be the last one on the list 💅. Otherwise, this enctype MUST NOT be negotiated if it wasn't included in the list 🙅‍♀️.

This negotiation extension SHOULD NOT be used when the client doesn't expect the subkey in the AP-REP message from the server 💀.

A quick note on key generation: the KDC has a strong Pseudo-Random Number Generator (PRNG) 🌈. So the client can take advantage of the randomness the KDC provides by reusing the KDC key data when generating keys 🎀. Implementations SHOULD use the service ticket session key value as a source of additional entropy when generating the negotiated subkey 😭. If the AP-REQ authenticator subkey is present, it MAY also be used as a source of entropy ✨.

The server MAY ignore the preference order the client indicated 🙈. How the client or the server chooses an enctype (meaning, how the preference order for the supported enctypes gets picked) is a local matter 🧚.

4. Security Considerations 🔐

The client's enctype list and the server's reply enctype are part of the encrypted data, so the security considerations are the same as those of the Kerberos encrypted data 🔒.

Okay, this part is serious. Both the EtypeList and the server's sub-session key are protected by the session key or sub-session key used for the AP-REQ 😱. As a result, if a key for a stronger enctype is negotiated underneath a key for a weaker enctype, an attacker who can break the weaker enctype can also discover the key for the stronger enctype 💀. The whole point of this extension is to minimize how much ciphertext gets encrypted under a weak enctype that an attacker has access to 🛡️.

5. Acknowledgements 🫶

The authors would like to thank the following people for their comments and suggestions: Ken Raeburn, Luke Howard, Tom Yu, Love Hornquist Astrand, Sam Hartman, and Martin Rex 💖.

6. Normative References 📚

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3961]  Raeburn, K., "Encryption and Checksum Specifications for
           Kerberos 5", RFC 3961, February 2005.

[RFC4120]  Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
           Kerberos Network Authentication Service (V5)", RFC 4120,
           July 2005.

[X680]     ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002,
           Information technology - Abstract Syntax Notation One
           (ASN.1): Specification of basic notation.

[X690]     ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-1:2002,
           Information technology - ASN.1 encoding Rules:
           Specification of Basic Encoding Rules (BER), Canonical
           Encoding Rules (CER) and Distinguished Encoding Rules
           (DER).

Authors' Addresses 🦋

Larry Zhu Microsoft Corporation One Microsoft Way Redmond, WA 98052 US

EMail: lzhu@microsoft.com

Paul Leach Microsoft Corporation One Microsoft Way Redmond, WA 98052 US

EMail: paulle@microsoft.com

Karthik Jaganathan Microsoft Corporation One Microsoft Way Redmond, WA 98052 US

EMail: karthikj@microsoft.com

Copyright (C) The Internet Society (2006).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 💜

The IETF takes no position on the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or on whether any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures for rights in RFC documents can be found in BCP 78 and BCP 79 📖.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr 🔗.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please send that information to the IETF at ietf-ipr@ietf.org 💌.

Acknowledgement 🎀

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA) 💖.

📦 where this page comes from