RFC 5021

Extended Kerberos Version 5 Key Distribution Center (KDC) Exchanges over TCP 🎀

okay bestie, here's the title block tea ☕ RFC 5021 is a Standards Track doc from the Network Working Group, written by S. Josefsson (SJD) in August 2007. it updates RFC 4120 and doesn't list anything it obsoletes 💖

this one is all about Kerberos V5 over TCP, and it's giving extensibility 🦋

---

Status of This Memo 📜

this doc is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions to make it better 🫶 for where the standardization state and status of this protocol sits, check the current edition of the "Internet Official Protocol Standards" (STD 1). distribution of this memo is unlimited 🌈

Copyright Notice ©️

Copyright (C) The IETF Trust (2007).

Abstract ✨

okay so this doc describes an extensibility mechanism for Kerberos V5 when it's running over TCP transports 🔥 it uses the reserved high-bit in the length field, and that bit can be used to negotiate TCP-specific Kerberos extensions. main character energy 💅

Table of Contents 🧚

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
2.  Conventions Used in This Document . . . . . . . . . . . . . . . 2
3.  Extension Mechanism for TCP Transport . . . . . . . . . . . . . 2
4.  Interoperability Consideration  . . . . . . . . . . . . . . . . 3
5.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4
7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 5
8.  Normative References  . . . . . . . . . . . . . . . . . . . . . 5
Appendix A.  Copying Conditions . . . . . . . . . . . . . . . . . . 6

---

1. Introduction 🧚

okay so the Kerberos V5 spec [3], in section 7.2.2, reserves the high order bit in the initial length field for TCP transport so it can be used for future expansion 🌸 this doc updates [3] to explain what happens when that bit is set. it's meant for extensions that are specific to the TCP transport, and that's the whole vibe ✨

2. Conventions Used in This Document 🎀

quick vibe check on the important words 💜 when this document uses "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL", those get read the way RFC 2119 [1] describes. no cap, that's the rule 🫶

3. Extension Mechanism for TCP Transport 💅

the reserved high bit of the request length field is how you signal that you're using this extension mechanism 🎀 when the reserved high bit is set in the length field, the remaining 31 bits of the initial 4 octets get read as a bitmap. each bit in the bitmask can be used to request a particular extension. those 31 bits form the "extension bitmask", and other documents are expected to describe the details for particular bits 🦋

a 4-octet value with only the high bit set, which means the extension bitmask is all zeros, is called a PROBE 👀 a client can send a probe to find out which extensions a KDC supports. a client can also set particular bits in the extension bitmask directly if it doesn't need to ask the KDC what's available before deciding what to request 🍓

clients aren't forced to use this extension mechanism, and further, they're expected to only use it when they wish to negotiate a particular extension ✨

okay so the protocol goes like this 🧚 The client MUST begin by sending a 4-octet value with the high bit set. the packet is then either a PROBE or a specific request for some extension(s). The client MUST NOT send additional data before the server has responded.

if a KDC gets a request for a set of extensions that it supports, it MUST respond by sending a 4-octet zero value, i.e., 0x00000000. the KDC MAY directly send additional data after the zero value, without waiting for the client to respond, as specified by the particular negotiated extension. (Note: A 4-octet zero value can never be sent by an implementation that conforms to RFC 4120 and that does not support this extension mechanism, because a KRB-ERROR is always of non-zero size.) 🙈

now the other case 💀 If a KDC receives a PROBE, or if a KDC does not support all extensions corresponding to set bits in the extension bitmask, the KDC MUST return 4 octets with the high bit set, and with the remaining bitmask indicating which extensions it supports. The KDC then MUST wait, and the client MUST send a second 4-octet value with the high bit set. If the second 4-octet value is a PROBE or an unsupported extension, the KDC MUST close the connection. this is how the client can shut down a session when the KDC didn't support an extension that the client needs, which is honestly iconic 👑 If the second 4-octet value is a supported extension, the KDC MUST respond by sending a 4-octet zero value, i.e., 0x00000000. The KDC MAY directly send additional data after the zero value, as specified by the particular negotiated extension.

the client and KDC SHOULD wait for the other side to respond according to this protocol, and the client and KDC SHOULD NOT close the connection prematurely. resource availability considerations may influence whether, and for how long, the client and KDC will wait for the other side to respond to a request ⏳

bestie, the KDC MUST NOT support the extension mechanism if it doesn't support any extensions 🙅 if no extensions are supported, the KDC MUST return a KRB-ERROR message with the error KRB_ERR_FIELD_TOOLONG and MUST close the TCP stream, similar to what an implementation that doesn't understand this extension mechanism would do.

when more than one non-high bit is set, the behaviour depends on the particular extension mechanisms 🌈 If a requested extension (bit X) doesn't specify how it interacts with another requested extension (bit Y), the KDC MUST treat the request as a PROBE or unsupported extension, and proceed as above.

Each extension MUST describe the structure of protocol data beyond the length field, and the behaviour of the client and KDC. in particular, the structure may be a protocol with its own message framing. If an extension mechanism reserves multiple bits, it MUST describe how they interact. the rules are the rules, periodt 💅✨

4. Interoperability Consideration 🫶

okay, the tea ☕ implementations with support for TCP that don't claim to conform to RFC 4120 may not handle the high bit correctly. the KDC behaviour may include closing the TCP connection without any response, and logging an error message in the KDC log. when this was written, this problem existed in modern versions of popular KDC implementations 😭

implementations that are having trouble getting the expected responses from a KDC might assume that the KDC doesn't support this extension mechanism. a client might remember that semi-permanently, so it doesn't keep triggering the same problematic behaviour on the KDC every time. care should be taken to avoid unexpected behaviour for the user when the KDC is eventually upgraded 🧚 implementations might also provide a way to enable and disable this extension on a per-realm basis. how to handle these backwards compatibility quirks is, in general, left unspecified 🙈

Intellectual Property ✨

okay so the IETF is not picking a side on whether any IPR claims are valid or how far they reach 💅 It also doesn't say whether you can get a license for the tech in this doc, and it hasn't gone hunting for patents on its own either 🫣 If you want the rules for rights in RFC docs, check out BCP 78 and BCP 79 📚

Got a license question? Copies of IPR disclosures sent to the IETF Secretariat are available, and so are any license assurances, plus the results of anyone trying to get a general license or permission to use these proprietary rights as an implementer or user. All of that lives in the IETF online IPR repository at http://www.ietf.org/ipr 🗂️✨

And if you know of any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to build this standard, the IETF wants to hear about it 🫶 Send it to ietf-ipr@ietf.org 💌

Acknowledgement 🌸

the RFC Editor function is funded right now by the Internet Society 💜 thank you, ISOC 🙌