RFC 5868

Problem Statement on the Cross-Realm Operation of Kerberos

📅 published May 2010, from ietf

Part 1 of 3 🎀

RFC 5868 💖

Okay bestie, here's the header tea ✨ This is RFC 5868, titled Problem Statement on the Cross-Realm Operation of Kerberos, published in May 2010 🌸 The authors are S. Sakane, K. Kamada, and S. Zrelli from Yokogawa Electric Corp., plus M. Ishiyama from Toshiba Corp. 👑 It's Category: Informational, so it's background and problem-finding, not a standards-track spec 📚 The ISSN is 2070-1721. The header doesn't list anything it obsoletes or updates 🦋

Abstract

Okay so this doc gives background on big Kerberos deployments in the industrial sector 🏭 The goal is to spot problems in the current Kerberos cross-realm authentication model from RFC 4120 🔥

It walks through some real large-scale industrial systems and lists the requirements and restrictions for authentication in those places 💅 It also pulls out a bunch of requirements from industrial automation. Those come from the factory floor, but they're general enough to apply to Kerberos cross-realm operations too ✨ Iconic crossover.

Status of This Memo

Not gonna lie, this one's a little formal, but here's the gist 💜 This document is not an Internet Standards Track specification. It's published purely for informational purposes 📖

It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community 🫶 It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 for that 🧚

Info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc5868 🌈

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as they stood on the publication date. Please actually read these, bestie, because they spell out your rights and restrictions for this doc 🙈 Code Components pulled out of this document need to include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🎀

1. Introduction ....................................................3
2. Kerberos System .................................................4
   2.1. Kerberos Basic Operation ...................................4
   2.2. Cross-Realm Operation ......................................4
3. Applying Cross-Realm Kerberos in Complex Environments ...........5
4. Requirements ....................................................7
5. Issues ..........................................................8
   5.1. Unreliability of Authentication Chain ......................8
   5.2. Possibility of MITM in the Indirect Trust Model ............8
   5.3. Scalability of the Direct Trust Model ......................9
   5.4. Exposure to DoS Attacks ....................................9
   5.5. Client's Performance ......................................10
   5.6. Kerberos Pre-Authentication Problem in Roaming Scenarios ..10
6. Implementation Considerations ..................................11
7. Security Considerations ........................................11
8. Acknowledgements ...............................................11
9. References .....................................................11
   9.1. Normative References ......................................11
   9.2. Informative References ....................................11

1. Introduction ✨

Okay, so Kerberos Version 5 is a widely deployed mechanism 🔐 It lets a server authenticate a client before giving that client access to a service. Each client belongs to a managed domain called a realm. Kerberos can still authenticate when a client and a server are in different realms, and that's called cross-realm authentication 🦋

There are several ways to use Kerberos in large-scale distributed systems 🌍 Those setups are usually split into several managed domains, either for geographical reasons or to run different management policies. To keep network operations smooth across all of them, a common authentication mechanism for the different managed domains is needed 💅 And when you use Kerberos cross-realm operation in these big distributed systems, some issues pop up 😭

Industrial automation is moving toward wider adoption of Internet standards, and Kerberos is honestly one of the best options for keeping communications in control networks confidential and intact, while still meeting performance and security requirements 🏭✨ The catch is that Kerberos cross-realm operations in large-scale industrial systems can introduce issues that cause performance and reliability problems 💀

This doc briefly describes Kerberos Version 5 and its cross-realm operation mode 📚 Then it covers two case-study systems that Kerberos could be applied to, and it describes seven requirements in those systems. Those requirements cover both management and operations, and they outline the various constraints Kerberos operations might be put under 👑 Finally, it lists six issues related to Kerberos cross-realm operations in those systems 🌸

Note that this doc might not cover every issue related to Kerberos cross-realm operations. New issues might show up later 🔮 It also doesn't propose any solution to the issues it describes. And publishing this doc doesn't mean every one of these issues has to be solved by IETF members. Detailed analysis, problem definitions, and exploration of possible solutions can happen as separate work items 🧚

This doc assumes you already know the terms and concepts from "The Kerberos Network Authentication Service (V5)" ([RFC4120]) 💜

2. Kerberos System 🎀

2.1. Kerberos Basic Operation

Kerberos [RFC4120] is a widely deployed authentication system 🔐 Its authentication process involves principals and a Key Distribution Center (KDC). Principals can be users or services. Each KDC keeps a database of principals and shares a secret key with each registered principal 🗝️

The authentication process lets a user acquire the credentials they need from the KDC 💖 Those credentials let services authenticate users before granting them access to resources. A big part of the credentials are called "tickets", and there are two kinds: the Ticket-Granting Ticket (TGT) and the service ticket 🎟️

The TGT is obtained periodically from the KDC. It has a limited lifetime, and once it expires the user has to renew it ⏳ The TGT is used to get the other kind of ticket, the service tickets. The user gets a TGT from the Authentication Service (AS), which is a logical component of the KDC. Getting a TGT is called the "AS exchange" 🌈

When the user asks for a TGT, the AS replies with a packet containing the credentials. Those credentials are the TGT plus a random key called the "TGS session key" ✨ The TGT holds information encrypted with a secret key tied to a special service, called the "TGS" (Ticket-Granting Service). The TGS session key is encrypted with the user's key, so the user can only get the TGS session key if she knows the secret key she shares with the KDC 🔑 Lowkey genius design.

Next, the TGT gets used to request a service ticket from the TGS, which is the second component of the KDC. Getting service tickets is called the "TGS exchange" 🎫 The request for a service ticket is a packet containing a TGT and an "Authenticator". The Authenticator is encrypted with the TGS session key and contains the user's identity plus timestamps, which protect against replay attacks ⏰

After decrypting the TGT the user sent, the TGS pulls out the TGS session key. It uses that session key to decrypt the Authenticator and authenticate the user 🫶 Then the TGS issues the credentials the user asked for. Those are a service ticket and a session key that the user will use to authenticate to the desired application service 🦋

2.2. Cross-Realm Operation

Kerberos has cross-realm authentication built in 🌍 This lets users get service tickets to access services in foreign realms. To reach those services, users first contact their home KDC and ask for a TGT to be used with the TGS of the foreign realm 📮 If the home realm and the foreign realm have a direct trust relationship (basically, they share inter-realm keys), the home KDC hands over the requested TGT 💅

But if the home realm doesn't share inter-realm keys with the foreign realm, we're in what's called an indirect trust model situation 🕸️ Here, the home KDC gives a TGT that works with an intermediary foreign realm, which is likely to share inter-realm keys with the target realm 🧭 The client uses this "intermediary TGT" to talk to the intermediary KDC, and that KDC repeats the steps the home KDC took 🔁

If the intermediary KDC doesn't share inter-realm keys with the target foreign realm, it points the user to another intermediary KDC, just like in the first exchange between the user and their home KDC 🙃 But if it does share inter-realm keys with the target realm, the intermediary KDC issues a TGT that works with the KDC of the target realm 🎉 After the client has a TGT for the desired foreign realm, it uses that to get service tickets from the TGS of the foreign realm. Finally, the user accesses the service with the service ticket 💖

When the realms belong to the same institution, the client or the KDC can automatically work out a chain of trust by following the DNS domain hierarchy and assuming a parent domain shares keys with all of its child sub-domains 🌳 But that assumption isn't always true, so in lots of situations the trust path has to be specified manually 🗺️ Since cross-realm operations with the indirect inter-realm trust model rely on intermediary realms, the success of the cross-realm operation totally depends on the realms that are part of the authentication path 😭🫶

3. Applying Cross-Realm Kerberos in Complex Environments ✨

okay so before we get into the requirements, we need to see what real systems this stuff would actually have to survive 🏭💅 this section walks through two real-life setups that cross-realm Kerberos could be used for. they'd naturally use different trust models, which means they'd need different things from cross-realm Kerberos. so it's basically a vibe check on what "big" looks like 👑

we're focusing on a real petrochemical company [SHELLCHEM] and looking at two of its plants. quick context: petrochemical companies make bulk petrochemicals and deliver them to big industrial customers 🧪 this company has 43 plants all over the world, run from operation sites in 35 countries. just two examples here, bestie 🫶

Example one: a centralized system. The first plant runs a centralized system [CSPC]. CSPC is also called China National Offshore Oil Corporation (CNOOC) and Shell Petrochemicals Company, and it's run by a joint enterprise of those two companies. honestly it's one of the biggest systems of its kind in the world 🌏 It sits on 3.4 square kilometers on the north coast of Daya Bay, in Guangdong, southeast China. the system has 3,000 network segments, and 16,000 control devices are hooked up to local area networks. those devices belong to 9 different subsystems. a single control device can have lots of control and monitoring points, and this plant has 200,000 control points in total. 3 different control centers handle all of that 🎛️

Example two: a distributed system. Another plant runs a distributed system [NAM] ⭐ The Nederlandse Aardolie Maatschappij (NAM) is run by a partnership company made of two enterprises that represent the oil company. this one is spread out geographically across 863 square kilometers in the northern part of the Netherlands 🇳🇱 There are 26 plants scattered around the area, and each one is called a "cluster". they're connected to each other by a private ATM WAN. every cluster has roughly 500-1,000 control devices, and each cluster is managed by its own local control center. across the whole NAM system, there are one million control points 🤯

The devices in both examples are kind of tiny and kind of struggling. In both setups, end devices are basically plugged into a local network with twisted-pair cable, and the bandwidth is low at 32 kbps 🐢 The end devices use low clock CPUs, like the H8 [RNSS-H8] and M16C [RNSS-M16C]. to save power, the clock on the CPU may be lowered too. that limits how much total energy the device can hold, which lowers the risk of explosions 💥 yes, that's a real reason, and it's a very serious one.

Why timing matters. a device on the network collects data from other devices so it can see what's going on in the system 👀 it then uses that data to decide how to control other devices, by sending instructions over the network. if data takes too long to travel through the network, normal operations can't be guaranteed 😰 In both examples, data has to get from one device to another within 1 second. other control system applications might need shorter or longer timescales, so this number isn't one-size-fits-all.

Outsourcing and walking agents. some jobs, like control, maintenance, and environmental monitoring, can be handed off to an external organization 🧑‍🔧 agents can also be sent to walk around the plant and gather information about how it's running, or to keep an eye on the plant from a remote site 🔭

4. Requirements ✨

this section lists requirements that come from the industrial automation use-case 📋 they're written in a generic way and aimed at the frameworks and architectures that sit underneath Kerberos cross-realm operations. the goal is to give future cross-realm framework or architecture work for Kerberos some solid foundational guidelines 🧱

R-1, R-2, R-3, and R-4 are about managing the divided system. R-5, R-6, and R-7 are about the restrictions in huge industrial networks like the ones from Section 3 🏗️

R-1 For organizational reasons and scalability needs, a management domain typically must be partitioned into two or more sub-domains of management. Therefore, any architecture and implementation solution to the Kerberos cross-realm problem must (i) support the case of cross-realm operations across multiple management domains and (ii) support delegation of management authority from one management domain to another management domain. This must be performed without any decrease in the security level or quality of those cross-realm operations and must not expose Kerberos entities to new types of attacks. 🔐

R-2 Any architecture and implementation solution to the Kerberos cross-realm problem must support the co-existence of multiple independent management domains on the same network. Furthermore, it must allow organizations (corresponding to different management domains) to delegate the management of a part of, or the totality of, their system at any one time. 🤝

R-3 Any architecture and implementation solution to the Kerberos cross-realm problem must allow the use-case in which one device operationally controls another device, but each belongs to different management domains, respectively. 🎮

R-4 Any architecture and implementation solution to the Kerberos cross-realm problem must address the fundamental deployment use-case in which the management domain traverses geographic boundaries and network topological boundaries. In particular, it must address the case where devices are geographically (or topologically) remote, even though they belong to the same management domain. 🌍

R-5 Any architecture and implementation solution to the Kerberos cross-realm problem must be aimed at reducing operational and management costs as much as possible. 💸

R-6 Any architecture and implementation solution to the Kerberos cross-realm problem must address the (limited) processing capabilities of devices, and implementations of solutions must be considered to aim at limiting or suppressing power consumption of such devices. 🔋

R-7 Any architecture and implementation solution to the Kerberos cross-realm problem must address the possibility of limited availability of communications bandwidth between devices within one domain, and also across domains. 📶

5. Issues ✨

this section lists the issues you run into with Kerberos cross-realm operations when it's used in large-scale systems like the ones in Section 3 🚨 it also keeps the requirements from Section 4 in mind, so you can see which requirements fix which problems 🔍

5.1. Unreliability of Authentication Chain 🔗

when the trust relationship between realms follows a chain or hierarchical model, cross-realm authentication just isn't dependable 😬 it depends heavily on intermediary realms, and those might not be under the same authority. if any realm on the authentication path is unavailable, then the principals of the end realms can't do cross-realm operations at all.

the end-point realms don't have full control over, or responsibility for, whether cross-realm operations succeed, even when their own KDCs are working perfectly 🙃 a system gets less dependable when it relies on components it doesn't control. end-point realms also have no way of knowing the authentication result that happens inside the intermediary realms.

Satisfying requirements R-1 and R-2 will eliminate (or considerably diminish) this issue of the unreliability of the authentication chain. 💡

5.2. Possibility of MITM in the Indirect Trust Model 😈

every KDC on the authentication path knows the shared secret between the client and the remaining KDCs on that path. that means a malicious KDC can perform man-in-the-middle (MITM) attacks on communications between the client and any KDC in the rest of the authentication chain. a malicious KDC may also learn the service session key that protects the communication between the client and the actual application service. and then it can use that key to run a MITM attack too. yikes 💀

[SPECCROSS] analyzed the cross-realm operations in Kerberos and gave a formal proof of the issue discussed in this section 📜

Satisfying requirements R-1 and R-2 will eliminate (or considerably diminish) this issue of MITM attacks by intermediate KDCs in the indirect trust model. 🛡️

5.3. Scalability of the Direct Trust Model 📈

in the direct trust relationship model, the realms involved in cross-realm operations share keys, and their respective TGS's principals are registered in each other's KDC. each realm has to maintain keys with every foreign realm it interacts with. this can get really cumbersome 😩 and it can push maintenance costs up as the number of realms grows.

Satisfying requirements R-1, R-2, and R-5 will eliminate (or considerably diminish) this issue of scalability of the direct trust model. ✅

5.4. Exposure to DoS Attacks 🌊

one assumption behind allowing cross-realm operations in Kerberos is that users can talk to KDCs located in remote realms. that practice brings real security threats, because KDCs are open to the public network 😨 administrators might want to restrict access to the KDC so only trusted realms can reach it. but that approach doesn't scale, and it doesn't really protect the KDC either 🙅‍♀️ when remote realms have several IP prefixes (for example, control centers or outsourcing companies located worldwide), the local KDC administrator has to collect the list of prefixes that belong to those organizations. the filtering rules then have to explicitly allow incoming traffic from any host in one of those prefixes. that makes the admin's job more complicated and more prone to human errors 🙈 it also raises maintenance costs. on the other hand, if a range of external IP addresses is allowed to communicate with the KDC, the risk of becoming a target for attacks from remote malicious users goes up 🎯

Satisfying requirements R-1, R-3, R-4, and R-5 will eliminate (or considerably diminish) this issue of exposure to denial-of-service (DoS) attacks. 🫧

5.5. Client's Performance 🎀

Okay so in Kerberos cross-realm operations, clients have to do TGS exchanges with all of the KDCs on the trust path, including the home KDC and the target KDC 😭 A TGS exchange needs real crypto work and can eat a LOT of processing time, especially when the client has limited compute power. So the overhead of cross-realm exchanges can cause delays that are honestly unacceptable 💀

We ported the MIT Kerberos library (version 1.2.4) and built a Kerberos client on our original board with an H8 (16-bit, 20 MHz) chip. Then we measured how long each Kerberos message took to process [KRBIMPL]. A TGS exchange took 195 milliseconds with the on-board H/W crypto engine ✨ Honestly that seems reasonable, given the response time the control network needs. BUT we did not change the H8's clock speed during our measurements 🙈 In a real system the H8 runs at a lowered clock speed, so the processing time has to be slower out in the wild. With devices like this, the delays can get unacceptable as the number of intermediary realms goes up 😩

Satisfying requirements R-1, R-2, R-6, and R-7 will eliminate (or considerably diminish) this client performance issue 💖

5.6. Kerberos Pre-Authentication Problem in Roaming Scenarios 🧚

Okay this one is a whole saga 🙃 In roaming scenarios, the client needs to contact her home KDC to get a cross-realm TGT for the local (or visited) realm. BUT the policy of the network access provider (or the gateway on the local network) usually won't let clients talk to hosts on the Internet unless they give valid authentication credentials. So the client is stuck in a chicken-and-egg situation where two things depend on each other 💀 The Internet connection is needed to reach the home KDC and get credentials, but the Internet connection is only granted to clients who already have valid credentials. As a result, Kerberos can't just be used as-is to authenticate roaming clients asking for network access. Usually people fix this with a VPN approach. However, we can't always set up VPNs between different sites 😤

Satisfying requirements R-3, R-4, and R-5 will eliminate (or considerably diminish) this roaming-related pre-authentication issue 🌈

6. Implementation Considerations 🫶

Okay this section is the serious part, bestie 📝 This document describes issues with Kerberos cross-realm operations. There are important things to think about when designing and implementing solutions for these issues. Solutions must not introduce new problems 🙅‍♀️ Any solution should use existing components or protocols as much as possible, and it should avoid introducing new component definitions. It should not require new changes to existing deployed clients, and as much as possible it should not influence the client code-base. A KDC is a super important server in a Kerberos-based information system, so any new burden on the KDC should be minimal 👑 Solutions have to take these tradeoffs and requirements into account. On the other hand, solutions are not required to solve all of the issues listed in this document at once 💅

7. Security Considerations 🔥

This document clarifies the issues with cross-realm operation of the Kerberos V system, and those issues include security issues that need to be considered. For more details, see Sections 5.1, 5.2, 5.3, and 5.4. Read those, no skipping 🫣💀

8. Acknowledgements 💜

The authors are so grateful to Nobuo Okabe, Kazunori Miyazawa, and Atsushi Inoue 🥹 They gave tons of comments and suggestions for this document from its very earliest stages. Nicolas Williams, Chaskiel Grundman, and Love Hornquist Astrand gave valuable suggestions and corrections ✨ Thomas Hardjono put in a huge amount of work and helped improve this document 🌸 Finally, the authors thank Jeffrey Hutzelman, who gave a lot of suggestions for completing this document 🫶

9. References 📚

9.1. Normative References

[RFC4120]   Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
            Kerberos Network Authentication Service (V5)", RFC 4120,
            July 2005.

9.2. Informative References

[CSPC]      "CSPC Nanhai - Shell Global Solutions",
            <http://www.shell.com/home/content/global_solutions/
            aboutshell/key_projects/nanhai/>.

[KRBIMPL]   "A Prototype of a Secure Autonomous Bootstrap Mechanism
            for Control Networks", Nobuo Okabe, Shoichi Sakane,
            Masahiro Ishiyama, Atsushi Inoue and Hiroshi Esaki,
            SAINT, pp. 56-62, IEEE Computer Society, 2006.

[NAM]       Nederlandse Aardolie Maatschappij BV,
            <http://www.nam.nl/>.

[RNSS-H8]   "H8 Family | Renesas Electronics",
            <http://www.renesas.com/products/mpumcu/h8/
            h8_landing.jsp>.

[RNSS-M16C] "M16C Family (R32C/M32C/M16C) | Renesas Electronics",
            <http://www.renesas.com/products/mpumcu/m16c/
            m16c_landing.jsp>.

[SHELLCHEM] "Shell Chemicals",
            <http://www.shell.com/home/content/chemicals>.

[SPECCROSS] I. Cervesato and A. Jaggard and A. Scedrov and C.
            Walstad, "Specifying Kerberos 5 Cross-Realm
            Authentication", Fifth Workshop on Issues in the Theory
            of Security, January 2005.

Authors' Addresses 🦋

Shoichi Sakane
Yokogawa Electric Corporation
2-9-32 Nakacho, Musashino-shi
Tokyo  180-8750 Japan
EMail: Shouichi.Sakane@jp.yokogawa.com


Ken'ichi Kamada
Yokogawa Electric Corporation
2-9-32 Nakacho, Musashino-shi
Tokyo  180-8750 Japan
EMail: Ken-ichi.Kamada@jp.yokogawa.com


Saber Zrelli
Yokogawa Electric Corporation
2-9-32 Nakacho, Musashino-shi
Tokyo  180-8750 Japan
EMail: Saber.Zrelli@jp.yokogawa.com


Masahiro Ishiyama
Toshiba Corporation
1, Komukai Toshiba-cho, Saiwai-ku
Kawasaki  212-8582 Japan
EMail: masahiro@isl.rdc.toshiba.co.jp

📦 where this page comes from

ietf: rfc5868 2010-05
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms