RFC 7751

Kerberos Authorization Data Container Authenticated by Multiple Message Authentication Codes (MACs)

📅 published March 2016, from ietf

RFC 7751: Kerberos Authorization Data Container Authenticated by Multiple Message Authentication Codes (MACs) 🎀

okay bestie, here's the vibe check on this doc 🦋

  • RFC number: 7751 ✨
  • Stream: Internet Engineering Task Force (IETF) 🌸
  • Authors: S. Sorce (Red Hat) and T. Yu (MIT) 👑
  • Category: Standards Track 💅
  • ISSN: 2070-1721
  • Date: March 2016 📅
  • Updates: 4120 (so it's updating RFC 4120) 🔥

Quick note: the header doesn't have an Obsoletes line, so this doc is only updating RFC 4120, not replacing it outright 🙈

Abstract

okay so this doc defines a Kerberos authorization data container that supersedes AD-KDC-ISSUED 💅 It lets you attach multiple Message Authentication Codes (MACs) or signatures to authenticate the authorization data elements inside it. And the reason we need multiple MACs? To fix the shortcomings of the existing AD-KDC-ISSUED container 😭 This doc updates RFC 4120 too.

Status of This Memo

This is an Internet Standards Track doc 🌈

It's a product of the IETF, so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 🫶 If you want more on Internet Standards, check out Section 2 of RFC 5741.

For the current status of this doc, any errata, and how to send feedback, head to http://www.rfc-editor.org/info/rfc7751 🧚

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 💜

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Read these carefully, bestie, because they spell out your rights and restrictions for this doc 📜 Code Components pulled out of this doc have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🍓

Table of Contents

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Requirements Language . . . . . . . . . . . . . . . . . . . .   2
3.  Motivations . . . . . . . . . . . . . . . . . . . . . . . . .   2
4.  Encoding  . . . . . . . . . . . . . . . . . . . . . . . . . .   4
5.  Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . .   6
6.  Assigned Numbers  . . . . . . . . . . . . . . . . . . . . . .   6
7.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
  8.1.  Normative References  . . . . . . . . . . . . . . . . . .   9
  8.2.  Informative References  . . . . . . . . . . . . . . . . .   9
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   9
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  10

1. Introduction ✨

okay so this doc specifies a brand new authorization data container for Kerberos, called the CAMMAC (Container Authenticated by Multiple MACs) 🦋 The Abstract Syntax Notation One (ASN.1) type that implements the CAMMAC concept is the AD-CAMMAC, and it supersedes the AD-KDC-ISSUED authorization data type from [RFC4120] 💅

The big win: this new container lets both the receiving application service and the Key Distribution Center (KDC) itself verify that the contained authorization data is authentic 🔥 The AD-CAMMAC can also carry extra verifiers that "trusted services" can use to check the contained authorization data too 🫶

2. Requirements Language 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be interpreted as described in RFC 2119 [RFC2119] 🌸

3. Motivations 💖

Okay, so Kerberos lets clients submit arbitrary authorization data for a KDC to stick into a Kerberos ticket 🧚 That client-requested authorization data lets the client express authorization restrictions that the application service is going to interpret. And honestly, with few exceptions, the KDC can safely copy that client-requested data onto the issued ticket without needing to inspect, interpret, or filter the contents 💅

Now, the AD-KDC-ISSUED container from RFC 4120 [RFC4120] is how KDCs include positive or permissive (rather than restrictive) authorization data in service tickets 🌈 The service named in the ticket can verify that the KDC really issued that data 🫶 This works because of a shared symmetric key between the KDC and the service. That key assures the service that the KDC didn't just copy client-requested authorization data onto the ticket without inspecting it 🔑

AD-KDC-ISSUED works well when authorization data flows from the KDC to the service 💜 But protocol extensions like Constrained Delegation (S4U2Proxy [MS-SFU]) need a service to show the KDC a service ticket the KDC previously issued. That's the evidence that the service is allowed to impersonate the client principal named in that ticket 😭 With S4U2Proxy, the KDC uses that evidence ticket as the basis for issuing a derivative ticket the service can then use to impersonate the client 🦋

Here's the tea: the authorization data inside the evidence ticket is a flow of authorization data from the application service to the KDC 👀 AD-KDC-ISSUED's properties just aren't enough for this use case, because the service knows the symmetric key for the checksum in AD-KDC-ISSUED. So the KDC has no way to detect whether the service tampered with the AD-KDC-ISSUED contents inside the evidence ticket 💀

The new AD-CAMMAC container fixes this by adding extra verifier elements 🛡️

The svc-verifier (service verifier) element of AD-CAMMAC has the same functional and security properties as the ad-checksum element of AD-KDC-ISSUED. So the svc-verifier lets the service verify the integrity of the AD-CAMMAC contents, just like it already could with AD-KDC-ISSUED 🎀 The kdc-verifier and other-verifiers elements are brand new to AD-CAMMAC, and they're what give it the enhanced capabilities ✨

The kdc-verifier element lets a KDC verify the integrity of authorization data it previously inserted into a ticket, using a key that only the KDC knows 🔐 That means the KDC doesn't have to recompute all of the authorization data for the issued ticket. And that recomputation might not always be possible, especially when the data includes ephemeral information like the strength or type of the authentication method used to get the original ticket 🙈

The verifiers in the other-verifiers element are not required 🌷 But they can be super useful when a lesser-privileged service gets a ticket from a client and needs to pull out the AD-CAMMAC. Why? To prove to a higher-privileged "trusted service" on the same host that it's legitimately acting on behalf of that client 👑 The trusted service can use a verifier from the other-verifiers element to validate the AD-CAMMAC contents without any extra communication with the KDC 🚀

4. Encoding 💖

okay so Kerberos is defined in [RFC4120] using ASN.1 [X.680] and the ASN.1 Distinguished Encoding Rules (DER) [X.690] 🧚. For consistency, this spec also uses ASN.1 to describe the layout of AD-CAMMAC. The ad-data of the AD-CAMMAC authorization data element is the ASN.1 DER encoding of the AD-CAMMAC ASN.1 type below ✨

KerberosV5CAMMAC {
        iso(1) identified-organization(3) dod(6) internet(1)
        security(5) kerberosV5(2) modules(4) cammac(7)
} DEFINITIONS EXPLICIT TAGS ::= BEGIN

IMPORTS
      AuthorizationData, PrincipalName, Checksum, UInt32, Int32
        FROM KerberosV5Spec2 { iso(1) identified-organization(3)
          dod(6) internet(1) security(5) kerberosV5(2)
          modules(4) krb5spec2(2) };
          -- as defined in RFC 4120.

AD-CAMMAC                   ::= SEQUENCE {
      elements              [0] AuthorizationData,
      kdc-verifier          [1] Verifier-MAC OPTIONAL,
      svc-verifier          [2] Verifier-MAC OPTIONAL,
      other-verifiers       [3] SEQUENCE (SIZE (1..MAX))
                                OF Verifier OPTIONAL
}

Verifier             ::= CHOICE {
      mac            Verifier-MAC,
      ...
}

Verifier-MAC         ::= SEQUENCE {
      identifier     [0] PrincipalName OPTIONAL,
      kvno           [1] UInt32 OPTIONAL,
      enctype        [2] Int32 OPTIONAL,
      mac            [3] Checksum
}

END

elements: A sequence of authorization data elements issued by the KDC. These are the authorization data that the verifier fields authenticate 🔐

Verifier: A CHOICE type that currently holds only one alternative, Verifier-MAC. Future extensions might add support for public-key signatures 🦋

Verifier-MAC: Holds an RFC 3961 [RFC3961] checksum (MAC) computed over the ASN.1 DER encoding of the AuthorizationData value in the elements field of the AD-CAMMAC. The identifier, kvno, and enctype fields help the recipient locate the key needed to verify the MAC. For the kdc-verifier and the svc-verifier, those fields are often obvious from context and MAY be omitted. For the kdc-verifier, the MAC is computed differently than for the svc-verifier and the other-verifiers, as we'll see later. The key usage number for computing the MAC (checksum) is 64 💅

kdc-verifier: A Verifier-MAC where the key is a long-term key of the local Ticket-Granting Service (TGS). The checksum type is the required checksum type for the enctype of the TGS key. This one is a bit special 👑. The KDC computes the MAC over the ASN.1 DER encoding of a modified version of the EncTicketPart of the surrounding ticket. To build that modified version, the KDC swaps out the AuthorizationData value that would normally sit in the authorization-data field of the EncTicketPart and puts in the AuthorizationData value from the elements field of the AD-CAMMAC instead. The original authorization-data field would have held the AD-CAMMAC itself, possibly alongside other authorization data sitting outside of the AD-CAMMAC. This altered computation binds the kdc-verifier to the rest of the ticket's contents, which assures the KDC that a malicious service hasn't swapped in a mismatched AD-CAMMAC taken from another ticket 🛡️

svc-verifier: A Verifier-MAC where the key is the same long-term service key the KDC uses to encrypt the surrounding ticket. The checksum type is the required checksum type for the enctype of the service key used to encrypt the ticket. This field MUST be present if the service principal of the ticket is not the local TGS, including when the ticket is a cross-realm Ticket-Granting Ticket (TGT) 🎀

other-verifiers: A sequence of additional verifiers 🌈. In each additional Verifier-MAC, the key is a long-term key of the principal name specified in the identifier field. The PrincipalName MUST be present and MUST be a valid principal in the realm. KDCs MAY add one or more "trusted service" verifiers. Unless otherwise administratively configured, the KDC SHOULD work out the "trusted service" principal name by replacing the service identifier component of the sname element of the surrounding ticket with "host". The checksum is computed using a long-term key of the identified principal, and the checksum type is the required checksum type for the enctype of that long-term key. The kvno and enctype SHOULD be specified so it's clear which of the trusted service's long-term keys is being used 🔑

Wait, I need to fix that last line: the original says "MUST be present and be a valid principal", so the wording above is slightly off in the first clause. Here is the corrected version of that paragraph:

other-verifiers: A sequence of additional verifiers 🌈. In each additional Verifier-MAC, the key is a long-term key of the principal name specified in the identifier field. The PrincipalName MUST be present and be a valid principal in the realm. KDCs MAY add one or more "trusted service" verifiers. Unless otherwise administratively configured, the KDC SHOULD work out the "trusted service" principal name by replacing the service identifier component of the sname element of the surrounding ticket with "host". The checksum is computed using a long-term key of the identified principal, and the checksum type is the required checksum type for the enctype of that long-term key. The kvno and enctype SHOULD be specified so it's clear which of the trusted service's long-term keys is used 🔑

5. Usage 🌸

Application servers and KDCs MAY ignore the AD-CAMMAC container and the authorization data elements it contains 🙈. For compatibility with older Kerberos implementations, a KDC issuing an AD-CAMMAC SHOULD enclose it in an AD-IF-RELEVANT container [RFC4120], unless the KDC knows the application server is likely to recognize it.

6. Assigned Numbers 🍓

RFC 4120 gets updated in the following ways:

  • The ad-type number 96 is assigned for AD-CAMMAC, updating the table in Section 7.5.4 of [RFC4120].
  • The table in Section 5.2.6 of [RFC4120] is updated to map the ad-type 96 to "DER encoding of AD-CAMMAC".
  • The key usage number 64 is assigned for the Verifier-MAC checksum, updating the table in Section 7.5.1 of [RFC4120].

7. Security Considerations 🚨

Okay, this section is the serious one, bestie 😭. The CAMMAC provides data origin authentication for the authorization data inside it, attesting that it came from the KDC. This section describes the precautions required to keep that data origin authentication intact as information flows around a Kerberos ticket that contains a CAMMAC.

When handling a TGS-REQ that contains a CAMMAC, a KDC makes a policy decision about how to produce the CAMMAC contents of the newly issued ticket, based on the properties of the ticket(s) that came along with the TGS-REQ. That policy decision can involve filtering, transforming, or copying the original CAMMAC contents verbatim. The following paragraphs give some guidance on writing these policies 📝.

A KDC verifies a CAMMAC as originating from a local-realm KDC when at least one of the following criteria is true:

  1. the KDC successfully verifies the kdc-verifier; or
  2. the KDC successfully verifies the svc-verifier, and the svc-verifier uses a key known only to the local-realm KDCs; or
  3. no verifiers are present, the ticket-encrypting key is known only to local-realm KDCs, and all local-realm KDCs properly filter out client-submitted CAMMACs. (This can require particular caution in a realm that has KDCs with mixed CAMMAC support, as might happen when incrementally upgrading KDCs in a realm to support CAMMAC.) 🧐

A CAMMAC that originates from a local-realm KDC might contain information that came from somewhere else 🌍. Originating from a local-realm KDC means that a local-realm KDC attests that the CAMMAC contents conform to the policies of the local realm, no matter where the information in the CAMMAC ultimately came from. That could be a remote realm, for example when the CAMMAC sits in a cross-realm TGT.

Local policy determines when a KDC can apply a kdc-verifier to a CAMMAC (or otherwise create a CAMMAC that meets the local-origin criteria listed above). Semantically, a CAMMAC that a KDC verifies as originating from a local-realm KDC attests that the CAMMAC contents conformed to local policy at the time the CAMMAC was created 🕰️. That local policy can include allowing verbatim copying of CAMMAC contents from cross-realm TGTs from designated remote realms, and applying a kdc-verifier to the new CAMMAC.

Usually, when a KDC verifies a CAMMAC as originating from a local-realm KDC, the KDC can assume the CAMMAC contents still conform to the policies of the local realm 💁. It's generally safe for a KDC to make verbatim copies of the contents of such a CAMMAC into a new CAMMAC when handling a TGS-REQ. Particularly strict implementations might run additional policy checks on the contents of a CAMMAC originating from a local-realm KDC if the policy of the local realm changes materially during the life of the CAMMAC 🔍.

A KDC MAY omit the kdc-verifier from the CAMMAC when it isn't needed, based on how realm policies will later treat the containing ticket. An implementation might choose this omission to reduce the size of the tickets it issues 📦. Some examples of when that omission is safe are:

  1. For a local-realm TGT, if all local-realm KDCs correctly filter out client-submitted CAMMACs, the local-realm origin criteria listed above allow omitting the kdc-verifier.
  2. An application service might not use the S4U2Proxy extension, or the realm policy might disallow that service from using S4U2Proxy. In those situations, where there's no flow of authorization data from the service to the KDC, the application service could modify the CAMMAC contents. But those modifications would have no effect on other services 🫶. Because there's no security impact on other application services, the KDC MAY omit the kdc-verifier from a CAMMAC contained in a ticket for that service.
Extracting a CAMMAC from a ticket for use as a credential takes it out of the context of the ticket 🚪. In the general case, that could turn it into a bearer token, with all of the security implications that come with that. Also, the CAMMAC doesn't necessarily contain enough information on its own to identify the client principal. So application protocols that rely on extracted CAMMACs might need to duplicate a substantial portion of the ticket contents and include that duplicated information in the authorization data inside the CAMMAC. How much duplication is needed depends on the security properties the application protocol requires 😬.

The method for computing the kdc-verifier binds it only to the authorization data contained within the CAMMAC. It does NOT bind the CAMMAC to any authorization data in the containing ticket that sits outside the CAMMAC 🙅. At least one (non-standard) authorization data type, AD-SIGNEDPATH, tries to bind to other authorization data in a ticket, and it's very difficult for two such authorization data types to coexist.

The kdc-verifier in CAMMAC does not bind the service principal name to the CAMMAC contents, because the service principal name is not part of the EncTicketPart 👀. An entity that has access to the keys of two different service principals can decrypt a ticket for one service and re-encrypt it with the key of the other service, altering the svc-verifier to match. Both the kdc-verifier and the svc-verifier would still validate, but the KDC never issued this fabricated ticket. The impact of this manipulation is minor if the CAMMAC contents only communicate attributes related to the client. If an application requires an authenticated binding between the service principal name and the CAMMAC or ticket contents, the KDC MUST include in the CAMMAC some authorization data element that names the service principal 🎯.

8. References 📚

8.1. Normative References

okay so the normative refs are the ones you have to read to get this spec, no cap 📚🎀

  • [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <http://www.rfc-editor.org/info/rfc2119>. 💖 this is the one that explains all the capital-letter rules, so it's giving foundation 🫶
  • [RFC3961] Raeburn, K., "Encryption and Checksum Specifications for Kerberos 5", RFC 3961, DOI 10.17487/RFC3961, February 2005, <http://www.rfc-editor.org/info/rfc3961>. 🔐 the crypto specs for Kerberos 5, iykyk
  • [RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The Kerberos Network Authentication Service (V5)", RFC 4120, DOI 10.17487/RFC4120, July 2005, <http://www.rfc-editor.org/info/rfc4120>. ✨ the main Kerberos V5 spec, literally the core of the whole thing
  • [X.680] ITU-T, "Information technology -- Abstract Syntax Notation One (ASN.1): Specification of basic notation", ITU-T Recommendation X.680, ISO/IEC International Standard 8824-1:2008, November 2008. 🧚 ASN.1 basic notation, the grammar language, periodt
  • [X.690] ITU-T, "Information technology -- ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, ISO/IEC International Standard 8825-1:2008, November 2008. 🌸 the encoding rules (BER, CER, DER), main character energy for the encoding part

8.2. Informative References

these ones are extra reading, not required, but they're iconic if you're curious 👀✨

  • [MS-SFU] Microsoft, "[MS-SFU]: Kerberos Protocol Extensions: Service for User and Constrained Delegation Protocol", October 2015, <http://msdn.microsoft.com/en-us/library/cc246071.aspx>. 🦋 Microsoft's take on the Kerberos extensions for user and constrained delegation

Acknowledgements

big thank-yous to Shawn Emery, Sam Hartman, Greg Hudson, Ben Kaduk, Barry Leiba, Meral Shirazipour, Zhanna Tsitkov, Qin Wu, and Kai Zheng, who gave super helpful technical and editorial feedback on earlier drafts 🫶💜 Thomas Hardjono also helped with the first round of editing when this document got split off from a predecessor that had a wider scope 🌈

Authors' Addresses

Simo Sorce Red Hat Email: ssorce@redhat.com

Tom Yu MIT Email: tlyu@mit.edu

these two are the people who wrote it, so they're the real MVPs 👑💅

📦 where this page comes from