RFC 5349

Elliptic Curve Cryptography (ECC) Support for Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)

📅 published September 2008, from ietf

Elliptic Curve Cryptography (ECC) Support for Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) 🦋

okay bestie, this is RFC 5349 🎀 It's an Informational doc from September 2008, written by L. Zhu, K. Jaganathan, and K. Lauter, all from Microsoft Corporation. It's not an Internet standard, just info for the community. Its title block doesn't list anything it obsoletes or updates, so it's kind of a standalone vibe. 💅

Status of This Memo ✨

so basically, this memo is here to give info to the Internet community. It's not an Internet standard of any kind, and it's free to share with anyone (distribution is unlimited) 🌸

Abstract 🦋

this doc explains how to use Elliptic Curve certificates, Elliptic Curve signature schemes, and Elliptic Curve Diffie-Hellman (ECDH) key agreement inside PKINIT. PKINIT is the Kerberos Version 5 extension that lets you use public key cryptography. It's giving "ECC gets to live inside Kerberos now" 👑

Table of Contents 🧚

1. Introduction
2. Conventions Used in This Document
3. Using Elliptic Curve Certificates and Elliptic Curve Signature Schemes
4. Using the ECDH Key Exchange
5. Choosing the Domain Parameters and the Key Size
6. Interoperability Requirements
7. Security Considerations
8. Acknowledgements
9. References
- 9.1. Normative References
- 9.2. Informative References

1. Introduction 💖

okay so ECC is honestly having a moment 🔥 It's a public-key cryptosystem that gives you the same security as the popular ones like RSA and DSA, but with smaller key sizes. Super efficient, no cap 💅 (see [LENSTRA] and [NISTSP80057])

here's the tea though: [RFC4556] already lets you use ECC algorithms, but it doesn't say how to pick the ECC parameters, or how to derive the shared key for key delivery using Elliptic Curve Diffie-Hellman (ECDH). That's the gap this doc fills. The sources for that are [IEEE1363] and [X9.63] 🫶

so this document shows how to use Elliptic Curve certificates, Elliptic Curve signature schemes, and ECDH together with [RFC4556]. The best part? There's no syntactic or semantic change to the existing [RFC4556] messages. Zero drama 🌈 Both the client and the Key Distribution Center (KDC) each contribute one ECDH key pair using the key agreement protocol described here. Bestie teamwork 👯‍♀️

2. Conventions Used in This Document 🎀

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📖✨

3. Using Elliptic Curve Certificates and Elliptic Curve Signature Schemes 🦋

ECC certificates and signature schemes can be used in the Cryptographic Message Syntax (CMS) [RFC3852] [RFC3278] content type 'SignedData' 💜

X.509 certificates [RFC5280] that contain ECC public keys or are signed using ECC signature schemes MUST comply with [RFC3279]. Non-negotiable, bestie 💀

the signatureAlgorithm field of the CMS data type 'SignerInfo' can contain one of the following ECC signature algorithm identifiers:

   ecdsa-with-Sha1   [RFC3279]
   ecdsa-with-Sha256 [X9.62]
   ecdsa-with-Sha384 [X9.62]
   ecdsa-with-Sha512 [X9.62]

the corresponding digestAlgorithm field holds one of these hash algorithm identifiers, respectively:

   id-sha1           [RFC3279]
   id-sha256         [X9.62]
   id-sha384         [X9.62]
   id-sha512         [X9.62]

so basically, id-sha1 MUST be used with ecdsa-with-Sha1, id-sha256 MUST be used with ecdsa-with-Sha256, id-sha384 MUST be used with ecdsa-with-Sha384, and id-sha512 MUST be used with ecdsa-with-Sha512. Every pair is locked in, periodt 🔒

implementations of this specification MUST support ecdsa-with-Sha256 and SHOULD support ecdsa-with-Sha1. ecdsa-with-Sha256 is the must-have, and Sha1 is the strong recommendation 🌸

4. Using the ECDH Key Exchange 🧚

this section explains how ECDH can be used as the Authentication Service (AS) reply key delivery method [RFC4556]. Fun fact: the protocol here is super similar to Modular Exponential Diffie-Hellman (MODP DH), which is also in [RFC4556] 🙈

if the client wants to use the ECDH key agreement method, it encodes its ECDH public key value and the key's domain parameters [IEEE1363] [X9.63] in clientPublicValue of the PA-PK-AS-REQ message [RFC4556] 💅

as described in [RFC4556], the ECDH domain parameters for the client's public key are specified in the algorithm field of the type SubjectPublicKeyInfo [RFC3279]. The client's ECDH public key value is mapped to a subjectPublicKey (a BIT STRING) according to [RFC3279] 🦋

the following algorithm identifier is used to identify the client's choice of the ECDH key agreement method for key delivery:

        id-ecPublicKey  (Elliptic Curve Diffie-Hellman [RFC3279])

if the KDC doesn't accept the domain parameters, it sends back an error message [RFC4120] with the code KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED [RFC4556]. This error message contains the list of domain parameters the KDC accepts. The list is encoded as TD-DH-PARAMETERS [RFC4556] and it's in the KDC's decreasing preference order. The client can then pick a set of domain parameters from the list and retry the authentication 🔁✨

both the client and the KDC MUST have local policy that specifies which set of domain parameters are acceptable, if they don't have a priori knowledge of the chosen domain parameters. Why this matters is explained in Section 7. Don't skip it 👀

if the KDC accepts the ECDH domain parameters, it sends back its ECDH public key value in the subjectPublicKey field of the PA-PK-AS-REP message [RFC4556] 🎀

as described in [RFC4556], the KDC's ECDH public key value is encoded as a BIT STRING according to [RFC3279] 💜

quick note: in the steps above, the client can tell the KDC it wants to reuse ECDH keys, or it can let the KDC decide to do so, by including the clientDHNonce field in the request [RFC4556]. Then the KDC can reuse the ECDH keys and include the serverDHNonce field in the reply [RFC4556]. This logic is the same as the Modular Exponential Diffie-Hellman key agreement method [RFC4556] 🫶

if ECDH is negotiated as the key delivery method, then the PA-PK-AS-REP and AS reply key are generated as in Section 3.2.3.1 of [RFC4556], with one difference. The ECDH shared secret value (an elliptic curve point) is calculated using operation ECSVDP-DH as described in Section 7.2.1 of [IEEE1363]. The x-coordinate of this point is converted to an octet string using operation FE2OSP as described in Section 5.5.4 of [IEEE1363]. This octet string is the DHSharedSecret 🔥

both the client and the KDC then proceed as described in [RFC4556] and [RFC4120] 🌈

lastly, ECDH can be used with any certificates and signature schemes. BUT, the big perk of pairing ECDH with ECC certificates and signature schemes is that the ECC domain parameters in the client certificates or the KDC certificates can be used. That means you don't need locally preconfigured domain parameters, as described in Section 7. Iconic efficiency 👑

Part 1 of 2 💖 Part 2 picks up at Section 5 (Choosing the Domain Parameters and the Key Size) with the curves, the key size table, and everything after it 🧚

7. Security Considerations 🔐

okay bestie, this section is SERIOUS but it's also kind of a masterclass, so grab your iced matcha 🍵 and let's go 💅

When you're doing ECDH key agreement, the recipient of an elliptic curve public key should perform the checks described in IEEE P1363, Section A16.10 [IEEE1363]. 🫶 And it's especially important if the recipient is using a long-term ECDH private key. You need to check that the sender's public key is a valid point on the correct elliptic curve. If you skip that, information may be leaked about the recipient's private key 😭, and iterating the attack will eventually completely expose the recipient's private key. That's not a vibe, that's a full-on disaster 💀

Next up: Kerberos error messages are NOT integrity protected 🙈 So the domain parameters the KDC sends as TD-DH-PARAMETERS can be tampered with by an attacker. The set of domain parameters that gets selected could end up being weaker, or not mutually preferred. The fix is local policy: you can configure sets of domain parameters that are acceptable locally, or you can disallow the negotiation of ECDH domain parameters altogether. Lock it down, babe 🔒✨

Now let's talk curve structure 🦋 Beyond elliptic curve size, the main issue is how much algebraic structure a curve has. As a general principle, it's more conservative to use elliptic curves with as little algebraic structure as possible. So random curves are more conservative than special curves (like Koblitz curves), and curves over F_p with p random are more conservative than curves over F_p with p of a special form. (Also, curves over F_p with p random might be considered more conservative than curves over F_2^m, because there's no choice between multiple fields of similar size for characteristic 2.) 🌸

Ngl though, algebraic structure can ALSO lead to implementation efficiencies, so implementors and users may need to balance conservatism against efficiency. It's a trade-off, not a rule carved in stone 💜 Concrete attacks are known against only very few special classes of curves, like supersingular curves, and those classes are excluded from the ECC standards such as [IEEE1363] and [X9.62]. Honestly iconic of them 👑

One more thing: there's the potential for catastrophic failures when a single elliptic curve is widely used. If an attack lands on that curve, it might result in the compromise of a large number of keys 😱 Again, this concern may need to be balanced against efficiency and interoperability improvements that come with widely used curves. If you want the deep dive, substantial additional information on elliptic curve choice can be found in [IEEE1363], [X9.62], and [FIPS186-2]. Go read those, main character energy 🧚

8. Acknowledgements 🎀

Huge shoutout to the people who made significant contributions to this document: Paul Leach, Dan Simon, Kelvin Yiu, David Cross, Sam Hartman, Tolga Acar, and Stefan Santesson. You all ate 🫶👑

9. References 📚

9.1. Normative References

[FIPS186-2]    NIST, "Digital Signature Standard", FIPS 186-2, 2000.

[IEEE1363]     IEEE, "Standard Specifications for Public Key
               Cryptography", IEEE 1363, 2000.

[NISTSP80057]  NIST, "Recommendation on Key Management", SP 800-57,
               August 2005,
               <http://csrc.nist.gov/publications/nistpubs/>.

[RFC2119]      Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3278]      Blake-Wilson, S., Brown, D., and P. Lambert, "Use of
               Elliptic Curve Cryptography (ECC) Algorithms in
               Cryptographic Message Syntax (CMS)", RFC 3278,
               April 2002.

[RFC3279]      Bassham, L., Polk, W., and R. Housley, "Algorithms and
               Identifiers for the Internet X.509 Public Key
               Infrastructure Certificate and Certificate Revocation
               List (CRL) Profile", RFC 3279, April 2002.

[RFC3766]      Orman, H. and P. Hoffman, "Determining Strengths For
               Public Keys Used For Exchanging Symmetric Keys",
               BCP 86, RFC 3766, April 2004.

[RFC3852]      Housley, R., "Cryptographic Message Syntax (CMS)",
               RFC 3852, July 2004.

[RFC4120]      Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
               Kerberos Network Authentication Service (V5)",
               RFC 4120, July 2005.

[RFC4556]      Zhu, L. and B. Tung, "Public Key Cryptography for
               Initial Authentication in Kerberos (PKINIT)",
               RFC 4556, June 2006.

[RFC5280]      Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
               Housley, R., and W. Polk, "Internet X.509 Public Key
               Infrastructure Certificate and Certificate Revocation
               List (CRL) Profile", RFC 5280, May 2008.

[X9.62]        ANSI, "Public Key Cryptography For The Financial
               Services Industry: The Elliptic Curve Digital
               Signature Algorithm (ECDSA)", ANSI X9.62, 2005.

[X9.63]        ANSI, "Public Key Cryptography for the Financial
               Services Industry: Key Agreement and Key Transport
               using Elliptic Curve Cryptography", ANSI X9.63, 2001.

9.2. Informative References

[LENSTRA]      Lenstra, A. and E. Verheul, "Selecting Cryptographic
               Key Sizes", Journal of Cryptography 14, 255-293, 2001.

[SEC2]         Standards for Efficient Cryptography Group, "SEC 2 -
               Recommended Elliptic Curve Domain Parameters",
               Ver. 1.0, 2000, <http://www.secg.org>.

Authors' Addresses 🏡

Larry Zhu
Microsoft Corporation
One Microsoft Way
Redmond, WA  98052
US

EMail: lzhu@microsoft.com


Karthik Jaganathan
Microsoft Corporation
One Microsoft Way
Redmond, WA  98052
US

EMail: karthikj@microsoft.com


Kristin Lauter
Microsoft Corporation
One Microsoft Way
Redmond, WA  98052
US

EMail: klauter@microsoft.com

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🧾

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

📦 where this page comes from

ietf: rfc5349 2008-09
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms