RFC 6784
Kerberos Options for DHCPv6
RFC 6784: Kerberos Options for DHCPv6 🦋
Okay bestie, this one is about giving DHCPv6 the power to hand out Kerberos info 🎀. It was written by S. Sakane from Cisco Systems and M. Ishiyama from Toshiba Corporation 💅. It's an Internet Standards Track document, so it's officially on the standards path ✨. It was published in November 2012 and has ISSN 2070-1721 🌸. The title block doesn't list anything it obsoletes or updates, so no drama there 🙈.
Abstract ✨
Okay so this doc defines four new options for DHCPv6 (the Dynamic Host Configuration Protocol for IPv6) 🌈. They carry configuration info for Kerberos, and that's literally the whole point 💖.
Status of This Memo 📋
This is an Internet Standards Track document 💜.
It's a product of the Internet Engineering Task Force (IETF) 🫶. It represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG) 👑. If you want more info on Internet Standards, check Section 2 of RFC 5741 🍓.
Info about the current status of this document, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6784 🧚.
Copyright Notice ⭐
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved 🔥.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication 🌸. Please actually read these, because they describe your rights and restrictions for this document 🙈. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 💅.
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008 🦋. The person(s) controlling the copyright in some of that material may not have granted the IETF Trust the right to allow modifications outside the IETF Standards Process 😭. So without an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process 💀. The one exceptions are formatting it for publication as an RFC or translating it into languages other than English 🌈.
Table of Contents 🗂️
1. Introduction ....................................................3
2. Conventions Used in This Document ...............................4
3. Kerberos Options ................................................4
3.1. Kerberos Principal Name Option .............................4
3.2. Kerberos Realm Name Option .................................5
3.3. Kerberos Default Realm Name Option .........................6
3.4. Kerberos KDC Option ........................................6
4. Client and Server Operation .....................................7
4.1. KDC Discovery for a Client .................................8
5. IANA Considerations .............................................8
6. Security Considerations .........................................9
7. Acknowledgments .................................................9
8. References .....................................................10
8.1. Normative References ......................................10
8.2. Informative References ....................................10
Appendix A. An Example of the Operation of the Client .............111. Introduction 🌸
Kerberos Version 5 [RFC4120] is a trusted third-party authentication system 🔐. Each organization that wants to use Kerberos sets up its own "realm", and every client gets registered as part of that realm 🏰. At least one Key Distribution Center (KDC) is required for a Kerberos realm to work 💖.
So here's the flow ✨. When a client wants to talk to a Kerberos application server (which is also a client of the KDC) and get authenticated to it, the client tells the KDC who it is and what its realm is, then gets a credential from the KDC 🎀. The client shows that credential to the application server, and the server can use it to authenticate the client 🫶. The client needs to know at least one IP address for a KDC before it can even start this process 🧚.
Here's an example 🦋. A student wants to use a shared public workstation that isn't set up for Kerberos 🍓. If the workstation has some way to get a realm name and a KDC IP address, then the student only has to type in a user-id and pass phrase to use Kerberos 💅.
The Kerberos V5 spec [RFC4120] uses DNS SRV records [RFC2782] for KDC discovery 🌈. But some systems, like industrial ones, don't use DNS at all 😭. They already have their own name spaces and name resolution systems (including preconfigured mapping tables for devices), and they don't use Fully Qualified Domain Names 🙈. Even so, a lot of these systems do use DHCP 💜.
Adding a DNS server to those systems might make them less reliable and cost more to manage 💀. So in that kind of environment, another mechanism is needed to give out an IP address for the KDC ⭐. For the PacketCable Architecture [PCARCH], RFC 3634 [RFC3634] defines the KDC Server Address sub-option for the DHCPv4 CableLabs Client Configuration option 🌸. But there's still no mechanism to hand out a realm name and an IPv6 address that doesn't depend on any external architecture 😤.
That's where this doc comes in 👑. It defines a Kerberos option for DHCPv6 that provides a realm name and/or a list of KDC IP addresses ✨. It doesn't replace or change any of the existing ways to get this info, so nothing breaks 🫶.
2. Conventions Used in This Document 📚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 💅.
It's assumed that readers already know the terms and concepts from DHCPv6 [RFC3315], Kerberos V5 [RFC4120], and DNS SRV [RFC2782] 🌈.
3. Kerberos Options 🎀
This document defines four DHCPv6 configuration parameters for Kerberos 💖. They are:
- Kerberos Principal Name Option
- Kerberos Realm Name Option
- Kerberos Default Realm Name Option
- Kerberos KDC Option
This section describes the format of each option and how each field in it is used 🦋.
These options, except for the Kerberos KDC Option, MUST NOT appear more than once in a DHCPv6 message 🚫.
3.1. Kerberos Principal Name Option 🧑💻
The Kerberos Principal Name Option carries the name of a Kerberos principal 🫶. The client sends it to the DHCPv6 server, and the server MAY use it to pick a specific set of configuration parameters, either for a client or for a Kerberos application server 🍓.
The format of the Kerberos Principal Name Option is:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_KRB_PRINCIPAL_NAME | option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
: :
: principal-name :
: (variable length) :
: :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+option-code(16 bits):OPTION_KRB_PRINCIPAL_NAME(75) 🔢option-len(16 bits): length of theprincipal-namefield ✨principal-name(variable): a client principal name 💜. The encoding of theprincipal-namefield MUST conform to the definition of "PrincipalName" in Section 5.2.2 of RFC 4120 [RFC4120] 🔥.
3.2. Kerberos Realm Name Option 🏰
The Kerberos Realm Name Option carries a Kerberos realm name 🌸. A DHCPv6 client uses this option to tell a DHCPv6 server which realm it wants to access 🦋.
The format of the Kerberos Realm Name Option is:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_KRB_REALM_NAME | option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
: :
: realm-name :
: (variable length) :
: :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+option-code(16 bits):OPTION_KRB_REALM_NAME(76) 🔢option-len(16 bits): the length of therealm-namefield in octets 📏realm-name(variable): a realm-name 💖. The encoding of therealm-namefield MUST conform to the definition of "Realm" in Section 5.2.2 of RFC 4120 [RFC4120] ✨.
3.3. Kerberos Default Realm Name Option 👑
The Kerberos Default Realm Name Option is used to specify a default realm name for the Kerberos system 🌈. A DHCPv6 server uses this option to tell both clients and Kerberos application servers which default realm name to use 🫶.
option-codeof this option isOPTION_KRB_DEFAULT_REALM_NAME(77) 🔢- The format and usage of the
option-lenandrealm-namefields are identical to those for the Kerberos Realm Name Option 🦋.
3.4. Kerberos KDC Option ✨
okay so the Kerberos KDC Option is the one that gives a client the config info for a KDC 🏰🔑 basically the details it needs to actually reach one, and it's giving main character energy 💅
the layout looks like this:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_KRB_KDC | option-len |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Priority | Weight |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Transport Type| Port Number | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
| |
| |
| KDC IPv6 address +---------------+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ :
: :
: realm-name :
: (variable length) :
: :
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+here's the fields tea 🍵
- option-code (16 bits):
OPTION_KRB_KDC(78) 🎀 - option-len (16 bits): 23 + the length of the realm-name field in octets. the math is giving clean 🧮
- Priority (16 bits): see the description of the Weight field 👀
- Weight (16 bits): the Priority and Weight fields give the client a hint about which KDC to pick 🎯 the usage of the Priority and Weight values MUST follow the specification for DNS SRV [RFC2782]. no vibes-based picking, it's SRV rules all the way ✨
- Transport Type (8 bits): this one tells you which transport protocol Kerberos is using 🚚 Kerberos [RFC4120] defines UDP and TCP transports. TCP exchanges are described further in [RFC5021], and running Kerberos over Transport Layer Security (TLS) is described in [RFC6251] 🔐
- Port Number (16 bits): the port the KDC is listening on 🚪
- KDC IPv6 address (128 bits): the IPv6 address of the KDC 🌐
- realm-name (variable): the name of the realm this KDC serves 🌸 the encoding of the realm-name field MUST conform to the definition of "Realm" in Section 5.2.2 of RFC 4120 [RFC4120]. no freestyling the spelling, bestie 💀
the transport types are below:
Value Transport Type
---- --------------
0 Reserved
1 UDP
2 TCP
3 TLS
4-254 Unassigned
255 Reserved4. Client and Server Operation 💅
this section covers what the client and server actually do 🫶 it assumes the client has already been set up with a principal name.
if a client needs a realm name, it sends a DHCPv6 Option Request Option (ORO) asking for the Kerberos Default Realm Name Option. the DHCPv6 server answers with a Reply message that includes a Kerberos Default Realm Name Option 🎁
if a client needs config parameters for a KDC, it sends a DHCPv6 ORO asking for the Kerberos KDC Option. the client MAY include a Kerberos Principal Name Option, and it MAY include a Kerberos Realm Name Option too 🧚
the DHCPv6 server replies with one or more sets of config parameters for a Kerberos KDC. if the client sent either a Kerberos Principal Name Option or a Kerberos Realm Name Option, the DHCPv6 server MAY use those to pick out specific sets of config parameters 🎯
when the server sends back more than one set, the way the client uses the Priority and Weight fields MUST follow the specification for DNS SRV [RFC2782]. yes, it's the same SRV rules again, we don't go rogue here 💖
the client MAY also include other options with data values as hints for the DHCPv6 server about parameter values it would love to get back. this is specified in Section 18.1.5 of RFC 3315 [RFC3315] 🦋
4.1. KDC Discovery for a Client
so when a client can do both the DNS method from Section 7.2.3.2 of [RFC4120] and the DHCP method in this doc, local policy decides which one it uses 🤷♀️ usually the realm admin sets this up in the client config before the client gets installed.
if no criteria were specified and the client could get the Kerberos info from either DNS or DHCPv6, the info from DNS SHOULD be preferred 🌈
5. IANA Considerations 📋
IANA has assigned four option codes from the DHCPv6 Option Codes registry:
75 OPTION_KRB_PRINCIPAL_NAME
76 OPTION_KRB_REALM_NAME
77 OPTION_KRB_DEFAULT_REALM_NAME
78 OPTION_KRB_KDCIANA also made a brand new sub-registry, the Kerberos Message Transport Types, which lives under the Kerberos Parameters registry 🗂️ the starting entries are the ones described in Section 3.4.
future entries get added through "IETF Review" policy, as described in BCP 26 [RFC5226]. under that policy, a document names the symbolic name of an entry, and IANA gives it a numeric code once publication is approved ✨
6. Security Considerations 🚨
okay this part is serious, so let's be serious for a sec 🙈
the security considerations in RFC 3315 [RFC3315] apply.
DHCPv6 messages can be modified in transit 😱 if an adversary changes the response from a DHCPv6 server, or injects their own, a client might get tricked into contacting a malicious KDC. both of those cases count as a Denial-of-Service (DoS) attack. the good news is that a malicious KDC doesn't know the shared key, so it can't go any further in the exchange 🔒 and if a client gets a response from a KDC like that, the client can use the shared key to detect that the message came from a malicious KDC.
a shared, unconfigured workstation might get its KDC info and default realm via DHCPv6 💻 that kind of workstation may not have a host or other service key, so it might not be able to validate the Ticket-Granting Ticket the KDC issued. a modified DHCPv6 response would then send the workstation to a malicious KDC, and the workstation wouldn't be able to tell it happened. that could let unauthorized users in 💀 so yeah, this is the scary one.
to cut down on those vulnerabilities, a client SHOULD use DHCPv6 authentication as defined in Section 21 of RFC 3315 [RFC3315] 🛡️
Kerberos info can also be configured manually on the client before it asks DHCPv6 for anything. manual configuration of the device SHOULD be preferred over configuration via the DHCPv6 server 🫡
7. Acknowledgments 🫶
the authors are super grateful to Nobuo Okabe and Shigeya Suzuki 🥰 they explained why DNS is a bad fit for some industry networks. Ted Lemon gave a bunch of suggestions to make the DHCP parts better 🌸 Ken'ichi Kamada and Yukiyo Akisada helped with the early work on this doc 🧚 Tom Petch made it easier to read 📖 and the authors also thank Jeffrey Hutzelman, Kazunori Miyazawa, Kensuke Hosoya, Nicolas Williams, Nobumichi Ozoe, Sam Hartman, and Stephen Farrell, who left valuable comments and suggestions. the whole group chat showed up for this one 💜
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2782] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
specifying the location of services (DNS SRV)", RFC 2782,
February 2000.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C.,
and M. Carney, "Dynamic Host Configuration Protocol for
IPv6 (DHCPv6)", RFC 3315, July 2003.
[RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
Kerberos Network Authentication Service (V5)", RFC 4120,
July 2005.
[RFC5021] Josefsson, S., "Extended Kerberos Version 5 Key
Distribution Center (KDC) Exchanges over TCP", RFC 5021,
August 2007.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.8.2. Informative References
[PCARCH] CableLabs, "PacketCable 1.0(TM) Architecture Framework
Technical Report", December 1999,
<http://www.packetcable.com/downloads/specs/
pkt-tr-arch-v01-991201.pdf>.
[RFC3634] Luehrs, K., Woundy, R., Bevilacqua, J., and N. Davoust,
"Key Distribution Center (KDC) Server Address Sub-option
for the Dynamic Host Configuration Protocol (DHCP)
CableLabs Client Configuration (CCC) Option", RFC 3634,
December 2003.
[RFC6251] Josefsson, S., "Using Kerberos Version 5 over the
Transport Layer Security (TLS) Protocol", RFC 6251,
May 2011.Appendix A. An Example of the Operation of the Client 🧭
okay the appendix is basically a choose-your-own-adventure for the client 🦋 when no criteria were specified and the client could get Kerberos info from either DNS or DHCPv6, the info from DNS SHOULD be preferred. here's an informational guide for that kind of setup:
No Resp. or
+------------+ DNS Info. +-----------+ No Resp.
Start --> | Ask DHCP(1)| ---------> | Ask DNS(3)| ------>
+------------+ +-----------+ Terminate(4)
/ \ \
Only KRB / \ DNS and \ KRB Info.
Info. / \ KRB Info. \
/ \ \
| | |
| V |
V No Ans. +-----------+ KRB Info. V
Use Info. <-------- | Ask DNS(6)| ---------> Use Info.
from DHCP +-----------+ from DNS
(2), (7) (5), (8)
Abbreviations:
Resp.: Response
Info.: Information
KRB : Kerberosthe steps go like this 👑
- initially, the client asks the DHCPv6 server for both DNS and Kerberos info 🙋♀️
- if the DHCPv6 server replies with Kerberos info and not DNS info, the client uses that info ✅
- if the DHCPv6 server doesn't reply, or replies with only DNS info, the client asks the DNS server for Kerberos info 🔍
- if the client gets no response, or no Kerberos info, from the DNS server, the client just terminates the process 💀
- if the client gets Kerberos info from the DNS server, the client uses that info 🎉
- if, as the result of step 1, the DHCPv6 server replies with both DNS and Kerberos info, the client asks the DNS server for Kerberos info 🤔
- if the client gets no response from the DNS server, the client uses the Kerberos info from the DHCPv6 server 🫶
- if, as the result of step 6, the DNS server replies with Kerberos info, the client uses the info from the DNS server and not the info from the DHCPv6 server 💅✨
Authors' Addresses ✨
okay bestie, here are the two lovely people who wrote this one 🫶
Shoichi Sakane 🎀 is from Cisco Systems:
Shoichi Sakane
Cisco Systems
9-7-1 Akasaka
Minato-ku, Tokyo 107-6227
Japan
EMail: ssakane@cisco.comMasahiro Ishiyama 🦋 is from Toshiba Corporation:
Masahiro Ishiyama
Toshiba Corporation
1, Komukai-toshiba-cho, Saiwai-ku,
Kawasaki, Kanagawa 212-8582
Japan
EMail: masahiro.ishiyama@toshiba.co.jpTwo authors, two companies, one very iconic spec 💅👑
📦 where this page comes from
- ietf: rfc6784 2012-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms