RFC 6717
kx509 Kerberized Certificate Issuance Protocol in Use in 2012
kx509 Kerberized Certificate Issuance Protocol in Use in 2012 🎀
okay bestie, this is RFC 6717 and it's giving real-world infrastructure 💅 It was written by H. Hotz (Jet Propulsion Lab, Caltech) and R. Allbery (Stanford University), dated August 2012. It's an Independent Submission, so it came from outside the usual IETF streams, and it's Informational, which means it's published for information and is NOT a standard. The ISSN is 2070-1721. The header doesn't list anything it obsoletes or updates, so it's not replacing or patching any other RFC 🧚
Abstract 🌸
okay so this doc describes a protocol called kx509 that uses Kerberos tickets to get X.509 certificates 🔐 The certs can be used for a lot of the same stuff as X.509 certs obtained some other way, but if you already have a Kerberos setup, the overhead of kx509 can be much less. lowkey iconic.
It's not standardized, but it's already being used at several big organizations, and certs issued with it are recognized by the International Grid Trust Federation 👑
Status of This Memo 🦋
This document is not an Internet Standards Track specification. It's published for informational purposes 💜
This is a contribution to the RFC Series, independently of any other RFC stream. The RFC Editor chose to publish it at their discretion and makes no statement about its value for implementation or deployment. Documents the RFC Editor approves for publication are not a candidate for any level of Internet Standard. See Section 2 of RFC 5741 for that 💅
Info about the current status of this document, any errata, and how to give feedback on it can be found at http://www.rfc-editor.org/info/rfc6717 ✨
Copyright Notice 🍓
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please review those documents carefully, because they describe your rights and restrictions with respect to this document 🫶
Table of Contents 🧚
1. Introduction ....................................................2
1.1. Requirements Language ......................................3
2. Protocol Data ...................................................3
2.1. Request Packet .............................................3
2.2. Reply Packet ...............................................4
3. Protocol Operation ..............................................7
4. Acknowledgements ................................................8
5. IANA Considerations .............................................8
6. Security Considerations .........................................9
7. References .....................................................10
7.1. Normative References ......................................10
7.2. Informative References ....................................10
Appendix A. Certificate Caching and Deployment Considerations ....12
Appendix B. Historic Extensions ..................................12
Appendix C. Example Exchange .....................................121. Introduction 💖
okay so the two main ways to get cryptographically secure identification on the Internet are Kerberos tickets [RFC4120] and X.509 [RFC5280] [X.509] certificates ✨
In real IT infrastructure where both are in use, it's highly desirable to deploy their support in a way that guarantees they both authoritatively refer to the same entities. There's already a widely adopted standard for using X.509 certs to get matching Kerberos tickets, called Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) [RFC4556]. This document describes the kx509 protocol, which handles the symmetric operation of getting X.509 certs using Kerberos tickets 🔥
Preparing and reviewing this doc exposed a bunch of issues that are discussed in the security considerations. Unfortunately, some of them can only be fixed with an incompatible upgrade to this protocol 💀 The IETF's Kerberos working group has an expected work item to address these issues 🙈
The International Grid Trust Federation [IGTF] supports the use of Short Lived Credential Services [SLCS] to authenticate for resource usage, based on other native identity stores that an organization maintains. X.509 certs issued using kx509 based on a Kerberos identity are one of the recognized credential services. The certificate profile for that use is outside the scope of this RFC, but it's described in [GRID-prof] 🌈
In normal operation, kx509 can be used after a Kerberos ticket-granting-ticket (TGT) is acquired, which most likely happens during user login. Here's the flow: first, the client generates an RSA public/private key pair. Next, using the Kerberos ticket-granting-ticket, it acquires a Kerberos service ticket for the KCA (Kerberized Certificate Authority) and uses that to send the public half of its key pair. The KCA decrypts the service ticket, verifies the integrity of the incoming packet, determines the identity of the user, and uses the session key to send back a corresponding X.509 certificate 🦋
1.1. Requirements Language 🎀
okay so the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖
2. Protocol Data 🌸
the protocol is a single request/reply exchange over UDP 📦
Both the request and the reply packet begin with four bytes of version ID information, followed by a DER-encoded ASN.1 message. The first two bytes of the version ID are reserved. They MUST be set to zero when sent and SHOULD be ignored when received. The third and fourth bytes are the major and minor version numbers, respectively. The version of the protocol described in this document is designated 2.0, so the first four bytes of the packet are 0, 0, 2, and 0 ✨
Incompatible variations of this protocol MUST use a different major version number 🙅♀️
2.1. Request Packet 💜
the request is a version ID followed by a DER-encoded ASN.1 message. That message holds a Kerberos AP-REQ, integrity check data on the request, and the public key the client generated. The ASN.1 encoding is:
KX509Request ::= SEQUENCE {
AP-REQ OCTET STRING,
pk-hash OCTET STRING,
pk-key OCTET STRING
}The AP-REQ is as described in [RFC4120], Section 5.5.1 🔑
The pk-hash is a Hashed Message Authentication Code (HMAC) using SHA-1 as the underlying hash. All 160 bits are sent. The key used is the Kerberos session key. The data to be hashed is the concatenation of the following:
- 4-byte version ID at the beginning of the packet.
- OCTET STRING of the AP-REQ.
- OCTET STRING of the pk-key.
The pk-key contains a public key. This key and its corresponding private key are generated by the client before it contacts the server. Implementations of this protocol MUST support RSA keys. In that case the key is a DER-encoded RSAPublicKey as defined in [RFC3447], Section A.1.1, and then it's stored in this octet string in the request. Its encoding as an OCTET STRING starts with the 0x30 byte sequence at the beginning of a DER-encoded RSAPublicKey. Use of other public-key types is not defined 🫶
⚠️ heads up: the pk-key has to be a DER-encoded RSAPublicKey for RSA keys, and implementations MUST support RSA. Other key types aren't defined in this doc at all, so don't go guessing 🙈
Appendix C shows an example request packet 🧚
2.2. Reply Packet 💌
okay so the reply is a version ID first, then a DER-encoded ASN.1 message with an error code, an optional authentication hash, an optional certificate, and optional error text 🎀 The service SHOULD send back replies in the same version as the request when it can, bestie 🫶
KX509Response ::= SEQUENCE {
error-code[0] INTEGER DEFAULT 0,
hash[1] OCTET STRING OPTIONAL,
certificate[2] OCTET STRING OPTIONAL,
e-text[3] VisibleString OPTIONAL
}the fields are all independently optional on paper, but the server MUST only ever send one of these allowed combos 💅
+------------+------+-------------+--------+
| | hash | certificate | |
| error-code | hash | | e-text |
| error-code | | | e-text |
+------------+------+-------------+--------+the first case is the happy one ✨ it happens when the server successfully makes a certificate for the user. the certificate is a DER-encoded certificate as defined in [RFC5280], Appendix A, page 116. its encoding as an OCTET STRING starts with the 0x30 byte sequence that's at the beginning of a DER-encoded certificate 🦋
the second case is when the server successfully authenticates the user and their key, but can't make a certificate for some other reason 😭
the third case MAY be returned if the server can't authenticate the user and wants to send back some unauthenticated info to the client 🙈
the hash on a response is computed using SHA-1 HMAC, same as the request 🔥
the data that gets hashed is all of these things glued together, in this order:
- the 4-byte version ID at the beginning of the packet.
- the DER representation of the error-code, exclusive of the tag and length, if it's present.
- the OCTET STRING of the certificate, if it's present.
- the VisibleString representation of the e-text, exclusive of the tag and length, if it's present.
basically the hash only looks at the fields that are actually there, without the outer ASN.1 wrapping 🌸
the e-text MAY be translated into other character sets for display purposes, but the hash is computed on the e-text in its VisibleString representation 🌈 and if the e-text has NUL characters in it, the client MAY ignore any part of the error message after the first NUL character when displaying it ⭐
as the table above shows, if the reply doesn't have a certificate, it MUST contain an error message and a non-zero error code. the other way around too: if a certificate is returned, then the error-code MUST be zero. the server SHOULD use the DEFAULT encoding for a zero error-code by leaving the explicit error-code out of the reply 🍓
these are the defined error-code values:
+------------+-----------------------------+------------------------+
| error-code | Condition | Example |
+------------+-----------------------------+------------------------+
| 1 | Permanent problem with | Incompatible version |
| | client request | |
| 2 | Solvable problem with | Expired Kerberos |
| | client request | credentials |
| 3 | Temporary problem with | Packet loss |
| | client request | |
| 4 | Permanent problem with the | Internal |
| | server | misconfiguration |
| 5 | Temporary problem with the | Server overloaded |
| | server | |
+------------+-----------------------------+------------------------+if a client error comes back, the client SHOULD NOT retry the request unless it first does some remedial action 🙅♀️ the one exception: if error-code 3 comes back, the client MAY retry with other servers before giving up 🧚
if a server error comes back, it is RECOMMENDED that the client retry with a different server, if it knows one 💜
all the KCAs serving a Kerberos realm are meant to be equivalent 👑 so, per Section 4.1.2.2 of [RFC5280], the certificates returned from different KCAs serving the same Kerberos realm MUST NOT contain duplicate serial numbers. no repeats, periodt 💖
this protocol and document do NOT deal with certificate verification or path construction. there's no provision for returning any extra certificates that might be needed. any application using a returned certificate must be configured on its own to handle this stuff. an incompatible upgrade to this protocol will add options for it later 🫠
the returned certificate MUST identify the Kerberos client principal from the AP-REQ in the original KX509Request, either in the subject of the certificate or in a subjectAltName extension ✨ and that identification MUST be unique within the organization's deployed infrastructure 🔐 it is RECOMMENDED that a subjectAltName extension be included, of type id-pkinit-san, as described in [RFC4556], Section 3.2.2. and fyi the id-pkinit-san is just a standard way to represent a Kerberos principal, it doesn't carry any other meaning for PKINIT 🎀
other extensions MAY be added according to local policy 🌷
Appendix C shows an example reply packet 🦋
3. Protocol Operation 🚀
if nothing goes wrong, the whole protocol is one request sent over UDP and one reply sent back over UDP 🫧
there's no special handling for requests or replies that are bigger than a UDP packet can hold 😬 also, some implementations have hard size limits that are smaller than a typical UDP MTU, which limits the use of extensions and the key sizes you can support 💀 and even without hard limits, if the request or reply goes over the MTU of a UDP packet on the infrastructure in use, the reliability of the exchange drops off a lot 📉
for "normal" Kerberos AP-REQ structures and "normal" X.509 certificates, this is unlikely, unless the Kerberos service ticket has a huge pile of authorization data in it. so it is RECOMMENDED that service tickets for the KCA be issued without authorization data 🧁 if the KCA does authorization, it should do it some other way 🌙
before building the request, the client must know the canonical name(s) and port(s) of the server(s) it's going to contact. it MAY figure those out by looking up the service's SRV record, as described in [RFC2782]. the entry to use is _kca._udp._realm_, where _realm_ is the Kerberos realm, used as part of the DNS name 🗺️
the client has to get a service ticket so it can build the AP-REQ for the service 🎟️ by convention, the Kerberos service principal name for this service has "kca_service" as its first component. unless there's local config or other outside knowledge about the right principal, the second and final component is conventionally the canonical name of the KCA server being contacted. and the realm of the principal is worked out with the usual Kerberos domain-to-realm mapping conventions, as discussed in [RFC4120], Section 1.3 🧠
when the server gets a request, it MUST verify these properties before it issues a certificate:
- the AP-REQ can be decoded and is not expired.
- if the request uses cross-realm authentication, then it satisfies the requirements of local policy and [RFC4120], Sections 1.2 and 2.7.
- the request's hash is valid.
the server SHOULD make other sanity checks too, like a minimum public key length, to the extent that's feasible 🧐
the server MAY decline to respond to a bad request 🙅 if the client doesn't get a response, the client MAY retry its request, but it SHOULD wait at least one second before doing that ⏳
the client MUST verify any hash in the reply, and it MUST NOT use any certificate in a reply whose hash doesn't verify 🔒 the client MAY display the e-text if the hash is absent or doesn't verify, but it SHOULD make it clear that the message is not authenticated 🚩
4. Acknowledgements 🫶
kx509 was originally implemented using Kerberos 4 at the University of Michigan, and it was nicely documented in [KX509] 📚 huge thanks to them for the original work, and to everyone who kept it updated since 💜
while this document was being written, important corrections and comments came from Jeffrey Altman and Love Hornquist Astrand 🙌 the following people also gave lots of helpful comments and corrections: Doug Engert, Jeffrey Hutzelman, Sam Hartman, Timothy J. Miller, Chaskiel Grundman, and Jim Schaad 🌟 Alan Sill pointed us to the International Grid Trust Federation and its acceptable credential services 🌍 and example network traffic came from Doug Engert, Marcus Watts, Matt Crawford, and Chaskiel Grundman, from their deployments. it was super useful for checking that this spec matches reality 🎀
5. IANA Considerations 📋
this service is conventionally run on UDP port 9878. IANA has registered that port in the Service Name and Transport Port Number Registry, like this:
Service Name: kca-service
Transport Protocol: UDP
Assignee: IESG <iesg@ietf.org>
Contact: IETF Chair <chair@ietf.org>
Description: The kx509 Kerberized Certificate Issuance
Protocol in Use in 2012
Reference: RFC 6717
Port Number: 9878
Assignment Notes: Historically, this service has been referred to
as "kca_service", but this service name does
not meet the registry requirements.the GSS-API / Kerberos / SASL service name that's currently in use for this protocol is "kca_service" 🫣 that doesn't meet the naming requirements for IANA's GSS-API/Kerberos/SASL service name registry, so no registration has been requested. the mismatch between the conventional service name and the registry rules is expected to be fixed in a future version of this protocol, and appropriate registrations will be requested at that time 🦋
6. Security Considerations 🔐
okay bestie, this is the serious section, so let's go 💅 The only encrypted info in this protocol is whatever Kerberos itself encrypts. Any Kerberized service's security considerations apply here too, no cap.
The public key in the request gets sent in the clear, and nothing guarantees the requester actually has the matching private key 😬. So the returned certificate is only appropriate where who's asking doesn't matter, or where the later use independently proves the user has that private key. The authors expect this to be addressed in a future version of the protocol ✨.
For example, if a kx509-issued certificate is used for a digital signature in a way that doesn't independently demonstrate proof-of-possession, an eavesdropper could request their own valid certificate through kx509 and claim to have originated material signed by the legit original requester. Iconic villain behavior 💀. [RFC4211], Appendix C, has a much deeper dive into why proof-of-possession matters.
An example that should be safe is initial client authentication over Transport Layer Security (TLS) [RFC5246] connections. If a client certificate is used, a Certificate Verify message (Section 7.4.8 of [RFC5246]) gets added to the handshake. It includes a signature over the handshake messages up to that point. Those messages depend on data only the client and server ends of that specific connection know, so computing the signature proves possession of the private key 🔑. This was the original intended use case for kx509 👑.
Some information, like the public key and certificate, is sent in the clear but (as the name implies) is generally meant to be public. Even so, its visibility could still raise privacy concerns 🙈. The hash is used to protect the integrity of this information 🫶.
The policies for issuing Kerberos tickets and X.509 certificates are usually expressed very differently. An implementation of this protocol should not provide a mechanism for bypassing ticket or certificate policies 🚫.
Specifically, if the issued certificate can be used with PKINIT, this authentication loop SHOULD NOT bypass policy limits for either X.509 certificates or Kerberos tickets.
X.509 certificates are usually issued with way longer validity times than Kerberos tickets, so be careful that the issued certificate isn't valid for longer than the intended policy should allow ⏳. Note that Section 3.2.3 of [RFC4556] REQUIRES that the lifetime of an issued ticket not exceed the lifetime of the predecessor certificate. By analogy, it is RECOMMENDED that the lifetime of an issued certificate not exceed the lifetime of the predecessor Kerberos ticket, unless the implications for local policy and supporting infrastructure are clearly understood and allow it 🌸.
7. References 📚
7.1. Normative References
[RFC2119]Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.[RFC3447]Jonsson, J. and B. Kaliski, "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1", RFC 3447, February 2003.[RFC4120]Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The Kerberos Network Authentication Service (V5)", RFC 4120, July 2005.[RFC5280]Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
7.2. Informative References
[GRID-prof]"Grid Certificate Profile", March 2008,<http://www.ogf.org/documents/GFD.125.pdf>.[IGTF]"The International Grid Trust Federation",<http://www.igtf.net/>.[KX509]Doster, W., Watts, M., and D. Hyde, "The KX.509 Protocol", September 2001,<http://www.citi.umich.edu/techreports/reports/citi-tr-01-2.pdf>.[RFC2782]Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2782, February 2000.[RFC4211]Schaad, J., "Internet X.509 Public Key Infrastructure Certificate Request Message Format (CRMF)", RFC 4211, September 2005.[RFC4556]Zhu, L. and B. Tung, "Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)", RFC 4556, June 2006.[RFC5246]Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.[SLCS]"Short Lived Credential Services", February 2009,<http://tagpma.org/authn_profiles/slcs>.[X.509]International Telecommunications Union, "Recommendation X.509: The Directory: Public-key and attribute certificate framework", November 2008.
Appendix A. Certificate Caching and Deployment Considerations 🗂️
As noted in the Security Considerations section, the functional lifetime of the acquired X.509 certificate should usually match the lifetime of its predecessor Kerberos ticket. Therefore, it is likely that X.509 certificates issued with this protocol should be deleted when the supporting Kerberos tickets are deleted. That makes the Kerberos ticket cache a reasonable location to store the certificate (and its private key) 💜.
On the other hand, applications, such as web browsers, probably expect certificates in different stores 🙃.
A widely used solution to this dichotomy is to implement a PKCS11 library that supports the kx509-acquired credentials. The credentials remain stored in the Kerberos credentials cache, but full PKI functionality is still available via a standard interface for PKI credentials ✨.
Appendix B. Historic Extensions 🕰️
This appendix documents extensions to the kx509 protocol that are either no longer in use or are expected to be dropped.
A subjectAltName othername extension of type kcaAuthRealm (OID value 1.3.6.1.4.1.250.42.1) is frequently used to include the client's realm as an ASN.1 octet string.
The Microsoft-defined userPrincipalName has frequently been used for the same purpose as the id-pkinit-san.
The historic implementations of this protocol included provisions for DSA keys in place of RSA. DSA does not appear to be in use. A future version of this protocol will use a standard certificate request structure that will provide algorithm agility 🌈.
The historic implementations of this protocol allowed an optional client-version field (at the end of the request) of type VisibleString. If present, the KCA copied it into the issued certificate as an extension with the OID 1.3.6.1.4.1.250.42.2. This feature does not appear to be in use 🥀.
Appendix C. Example Exchange 🧚
The request and reply are from the same exchange. The Ethernet, IP, and UDP headers, and the 4-byte version string at the beginning of the request and reply packets are all omitted. Only the ASN.1-encoded portions are shown.
0:d=0 hl=4 l= 678 cons: SEQUENCE
4:d=1 hl=4 l= 509 prim: OCTET STRING
[HEX DUMP]:6E8201F9308201F5A003... (AP-REQ)
517:d=1 hl=2 l= 20 prim: OCTET STRING
[HEX DUMP]:ECFF1C922300D0E9DD02... (pk-hash)
539:d=1 hl=3 l= 140 prim: OCTET STRING
[HEX DUMP]:30818902818100B70F46... (pk-key)
Request Packet ASN.1 Decode
0:d=0 hl=4 l= 870 cons: SEQUENCE
4:d=1 hl=2 l= 22 cons: cont [ 1 ]
6:d=2 hl=2 l= 20 prim: OCTET STRING
[HEX DUMP]:F3A844834C26D843B6FD... (hash)
28:d=1 hl=4 l= 842 cons: cont [ 2 ]
32:d=2 hl=4 l= 838 prim: OCTET STRING
[HEX DUMP]:308203423082022AA003... (certificate)
Reply Packet ASN.1 DecodeAuthors' Addresses 🖋️
Henry B. Hotz
Jet Propulsion Laboratory, California Institute of Technology
4800 Oak Grove Dr.
Pasadena, CA 91109
USA
Phone: +01 818 354-4880
EMail: hotz@jpl.nasa.gov
Russ Allbery
Stanford University
P.O. Box 20066
Stanford, CA 94309
USA
EMail: rra@stanford.edu
URI: http://www.eyrie.org/~eagle/📦 where this page comes from
- ietf: rfc6717 2012-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms