RFC 6542
Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Channel Binding Hash Agility
RFC 6542: Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Channel Binding Hash Agility 🎀
Okay bestie, so this one's by Shawn Emery from Oracle, published March 2012 🌸. It's a Standards Track doc, and it updates RFC 4121 (it doesn't list anything it obsoletes). It's also part of the ISSN 2070-1721 series 💜.
Abstract 🦋
Okay so right now, channel bindings use an MD5 hash in the Kerberos Version 5 GSS-API mechanism (RFC 4121). This doc updates RFC 4121 so channel bindings can use algorithms negotiated through the Kerberos crypto framework from RFC 3961 🔥. Also, since this update uses the last extensible field in the Kerberos client-server exchange message, it defines extensions so future protocol stuff can be added later ✨.
Status of This Memo 📜
This is an Internet Standards Track document.
It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community 🫶. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.
For the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc6542 💅.
Copyright Notice ©️
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 🌈.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as of the publication date. Please read these carefully, because they explain your rights and restrictions for this document 🙈. Code Components pulled out of this document must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes.
Table of Contents 🍓
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. Channel Binding Hash Agility ....................................2
3.1. Structure of the Exts Field ................................3
3.2. The Channel Binding Extension ..............................4
4. Security Considerations .........................................4
5. IANA Considerations .............................................4
6. Acknowledgments .................................................5
7. References ......................................................5
7.1. Normative References .......................................5
7.2. Informative References .....................................51. Introduction 🧚
Okay so MD5 has been found to have weaknesses (see [RFC6151]), which means we NEED stronger hash algorithms 💀. The Kerberos Version 5 GSS-API mechanism [RFC4121] uses MD5 to calculate channel binding verifiers. This doc specifies an update that lets it build channel binding information from negotiated algorithms. That way, new algorithms can roll out gradually without breaking interoperability with older implementations when new attacks show up later 😭✨.
2. Conventions Used in This Document 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
Quick terms: "little-endian order" means least-significant-octet-first encoding, and "big-endian order" means most-significant-octet-first encoding 💖.
3. Channel Binding Hash Agility 🦋
When generating a channel binding verifier, Bnd, a hash is computed from the channel binding fields. Initiators MUST populate the Bnd field so they stay interoperable with existing acceptors 🫶. On top of that, initiators MUST populate the extension field (Exts) defined below ✨.
3.1. Structure of the Exts Field 🎀
The 0x8003 GSS checksum has the same structure as in [RFC4121], except now the Exts field is defined. Here's the whole 0x8003 checksum structure, Exts included 👑:
Octet Name Description
-----------------------------------------------------------------
0..3 Lgth Number of octets in Bnd field, represented
in little-endian order; currently contains
hex value 10 00 00 00 (16).
4..19 Bnd Channel binding information, as described in
Section 4.1.1.2 of [RFC4121].
20..23 Flags Four-octet context-establishment flags in
little-endian order as described in Section
4.1.1.1 of [RFC4121].
24..25 DlgOpt The delegation option identifier (=1) in
little-endian order [optional]. This field
and the next two fields are present if and
only if GSS_C_DELEG_FLAG is set as described
in Section 4.1.1.1 of [RFC4121].
26..27 Dlgth The length of the Deleg field in
little-endian order [optional].
28..(n-1) Deleg KRB_CRED message (n = Dlgth + 28) [optional].
n..last Exts Extensions.So Exts is the concatenation of zero, one, or more individual extensions, and each one has these parts, in order 🌸:
type -- big-endian-order unsigned integer, 32 bits, which
contains the type of extension
length -- big-endian-order unsigned integer, 32 bits, which
contains the length, in octets, of the extension data
encoded as an array of octets immediately following
this field
data -- octet string of extension informationIf multiple extensions show up, there MUST be at most one instance of any given extension type 🚨.
3.2. The Channel Binding Extension 💅
When channel binding is used, the Exts MUST include the following extension 🔥:
data-type 0x00000000
data-value
The output obtained by applying the Kerberos V get_mic
operation [RFC3961] with key usage number 43 to the channel
binding data as described in [RFC4121], Section 4.1.1.2 (using
get_mic instead of MD5). The key used is the sub-session key
from the authenticator, if it is present; otherwise, the key
used is the session key from the ticket. The get_mic algorithm
is chosen as the "required checksum mechanism" for the
encryption type of the key used.And if an initiator isn't willing to use an MD5 hash of the channel bindings, it MUST set the Bnd field to sixteen octets of hex value FF 🙅♀️.
4. Security Considerations 🔐
Okay, this part is serious 😭. With this mechanism, initiators get NO indication of whether acceptors check or ignore channel bindings 💀.
It's up to the application whether to enforce channel bindings. [RFC5056] and [RFC5554] give application developers guidance on using them 📚.
5. IANA Considerations 🧾
IANA made a brand new top-level registry called "Kerberos V GSS-API Mechanism Parameters," separate from the existing Kerberos parameters registry 🌈. Inside it, IANA created a sub-registry called "Kerberos V GSS-API Mechanism Extension Types." Its entries have four fields (Type Number, Type Name, Description, and Reference). It starts with one registration: 0x00000000, "Channel Binding MIC," "Extension for the verifier of the channel bindings," [RFC6542] ✨.
Type number assignments follow the allocation guidelines in [RFC5226] 👑:
0x00000000 - 0x000003FF IETF Review
0x00000400 - 0xFFFFF3FF Specification Required
0xFFFFF400 - 0xFFFFFFFF Private Use6. Acknowledgments 🫶
Huge thanks to Larry Zhu, Nicolas Williams, Sam Hartman, Jeffrey Hutzelman, and Simon Josefsson for reviewing and giving super valuable feedback 💜.
7. References 📖
7.1. Normative References
[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.[RFC3961]Raeburn, K., "Encryption and Checksum Specifications for Kerberos 5", RFC 3961, February 2005.[RFC4121]Zhu, L., Jaganathan, K., and S. Hartman, "The Kerberos Version 5 Generic Security Service Application Program Interface (GSS-API) Mechanism: Version 2", RFC 4121, July 2005.[RFC5226]Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008.
7.2. Informative References
[RFC5056]Williams, N., "On the Use of Channel Bindings to Secure Channels", RFC 5056, November 2007.[RFC5554]Williams, N., "Clarifications and Extensions to the Generic Security Service Application Program Interface (GSS-API) for the Use of Channel Bindings", RFC 5554, May 2009.[RFC6151]Turner, S. and L. Chen, "Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms", RFC 6151, March 2011.
Author's Address 📮
Shawn Emery Oracle 500 Eldorado Blvd, Building 1 Broomfield, CO 80021 USA
EMail: shawn.emery@oracle.com
📦 where this page comes from
- ietf: rfc6542 2012-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms