RFC 7802

A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism

📅 published March 2016, from ietf

RFC 7802: A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism 🎀

Okay bestie, this is RFC 7802 💖. S. Emery (Oracle) and N. Williams (Cryptonector) wrote it, and it was published in March 2016 as a Standards Track document, which means it's official IETF consensus and very much a whole-ass standard 👑. The ISSN is 2070-1721. It obsoletes RFC 4402 and reclassifies that one as Historic 🙈.

Abstract ✨

Okay so this doc defines the Pseudo-Random Function (PRF) for the Kerberos V mechanism of the Generic Security Service Application Program Interface (GSS-API) 🔐. It's based on the PRF from the Kerberos V cryptographic framework, and its whole job is keying application protocols once you've got an established Kerberos V GSS-API security context 🗝️.

This doc obsoletes RFC 4402 and reclassifies it as Historic. RFC 4402 starts the PRF+ counter at 1, but a bunch of implementations start it at 0 😭. So the original spec wouldn't be interoperable with the implementations that already exist. Big oof.

Status of This Memo 📜

This is an Internet Standards Track document.

It's a product of the Internet Engineering Task Force (IETF), it represents the consensus of the IETF community, it got public review, and the Internet Engineering Steering Group (IESG) approved it for publication 🫶. If you want more on Internet Standards, check Section 2 of RFC 5741.

For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc7802 🌸.

Copyright Notice 💅

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the date of publication. Please actually read these, because they spell out your rights and restrictions for this document 📖. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 🦋.

Table of Contents 🗺️

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Conventions Used in This Document . . . . . . . . . . . . . .   2
   3.  Kerberos V GSS Mechanism PRF  . . . . . . . . . . . . . . . .   3
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   3
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
   6.  Normative References  . . . . . . . . . . . . . . . . . . . .   4
   Appendix A.  Test Vectors . . . . . . . . . . . . . . . . . . . .   6
   Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   8
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8

1. Introduction ✨

Okay so this doc specs the Kerberos V GSS-API mechanism's pseudo-random function, the one from [RFC4121] that lines up with [RFC4401] 🧚. It's a "PRF+" style construction, which is basically a counter-based extension. If you want the full picture, go read [RFC4401], [RFC2743], [RFC2744], and [RFC4121] 📚.

This doc obsoletes RFC 4402 and reclassifies it as Historic. RFC 4402 starts the PRF+ counter at 1, but a number of implementations start the counter at 0. As a result, the original specification would not be interoperable with existing implementations. It's giving "we need to fix this" energy 🙈.

2. Conventions Used in This Document 📏

Here's the official vocab: the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🎀.

3. Kerberos V GSS Mechanism PRF 🔐

Okay so the GSS-API PRF [RFC4401] for the Kerberos V mechanism [RFC4121] is a PRF+ function. It's built on the encryption type's PRF function, keyed with the negotiated session key of the security context that matches the 'prf_key' input parameter of GSS_Pseudo_random() 🗝️.

This PRF+ MUST be keyed with the key that the 'prf_key' input parameter points to, like this:

GSS_C_PRF_KEY_FULL -- use the sub-session key asserted by the acceptor (if any exists), or the sub-session asserted by the initiator (if any exists), or the Ticket's session key.
GSS_C_PRF_KEY_PARTIAL -- use the sub-session key asserted by the initiator (if any exists) or the Ticket's session key.

The PRF+ function is a simple counter-based extension of the Kerberos V pseudo-random function [RFC3961] for the encryption type of the security context's keys. The math goes like this 🧮:

      PRF+(K, L, S) = truncate(L, T0 || T1 || .. || Tn)

      Tn = pseudo-random(K, n || S)

Here's the breakdown 💕. K is the key from the 'prf_key' parameter. || is concatenation. n gets encoded as a network byte order 32-bit unsigned binary number. truncate(L, S) cuts the input octet string S down to length L. And pseudo-random() is the Kerberos V pseudo-random function [RFC3961].

The maximum output size of the Kerberos V mechanism's GSS-API PRF is, necessarily, 2^32 times the output size of the pseudo-random() function for the encryption type of the given key 🌈.

When the input size is longer than 2^14 octets as per [RFC4401] and exceeds an implementation's resources, then the mechanism MUST return GSS_S_FAILURE and GSS_KRB5_S_KG_INPUT_TOO_LONG as the minor status code 🚨.

Appendix A. Test Vectors 🧪✨

okay so the test vectors here are from the MIT implementation, and Greg Hudson is the one who put them together 🫶 he's the reason we have real numbers to check against. 🎀 The test cases use input strings of 0 and 61 bytes, and an output length of 44 bytes. The 61-byte input is kinda perfect because it's just enough to make a partial second MD5 or SHA1 hash block once you add the four-byte counter prefix 🤓 and 44 bytes of output means you need two full RFC 3961 PRF outputs plus one partial one, for all the existing enctypes 💅 and the keys? all randomly generated, no cap 🎲

Enctype: des-cbc-crc
Key: E607FE9DABB57AE0
Input: (empty string)
Output: 803C4121379FC4B87CE413B67707C4632EBED2C6D6B7
        2A55E878836E35E21600D915D590DED5B6D77BB30A1F

Enctype: des-cbc-crc
Key: 54758316B6257A75
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: 279E4105F7ADC9BD6EF28ABE31D89B442FE0058388BA
        33264ACB5729562DC637950F6BD144B654BE7700B2D6

Enctype: des3-cbc-sha1
Key: 70378A19CD64134580C27C0115D6B34A1CF2FEECEF9886A2
Input: (empty string)
Output: 9F8D127C520BB826BFF3E0FE5EF352389C17E0C073D9
        AC4A333D644D21BA3EF24F4A886D143F85AC9F6377FB

Enctype: des3-cbc-sha1
Key: 3452A167DF1094BA1089E0A20E9E51ABEF1525922558B69E
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: 6BF24FABC858F8DD9752E4FCD331BB831F238B5BE190
        4EEA42E38F7A60C588F075C5C96A67E7F8B7BD0AECF4

Enctype: rc4-hmac
Key: 3BB3AE288C12B3B9D06B208A4151B3B6
Input: (empty string)
Output: 9AEA11A3BCF3C53F1F91F5A0BA2132E2501ADF5F3C28
        3C8A983AB88757CE865A22132D6100EAD63E9E291AFA

Enctype: rc4-hmac
Key: 6DB7B33A01BD2B72F7655CB7B3D5FA0B
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: CDA9A544869FC84873B692663A82AFDA101C8611498B
        A46138B01E927C9B95EEC953B562807434037837DDDF

Enctype: aes128-cts-hmac-sha1-96
Key: 6C742096EB896230312B73972FA28B5D
Input: (empty string)
Output: 94208D982FC1BB7778128BDD77904420B45C9DA699F3
        117BCE66E39602128EF0296611A6D191A5828530F20F

Enctype: aes128-cts-hmac-sha1-96
Key: FA61138C109D834A477D24C7311BE6DA
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: 0FAEDF0F842CC834FEE750487E1B622739286B975FE5
        B7F45AB053143C75CA0DF5D3D4BBB80F6A616C7C9027

Enctype: aes256-cts-hmac-sha1-96
Key: 08FCDAFD5832611B73BA7B497FEBFF8C954B4B58031CAD9B977C3B8C25192FD6
Input: (empty string)
Output: E627EFC14EF5B6D629F830C7109DEA0D3D7D36E8CD57
        A1F301C5452494A1928F05AFFBEE3360232209D3BE0D

Enctype: aes256-cts-hmac-sha1-96
Key: F5B68B7823D8944F33F41541B4E4D38C9B2934F8D16334A796645B066152B4BE
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: 112F2B2D878590653CCC7DE278E9F0AA46FA5A380B62
        59F774CB7C134FCD37F61A50FD0D9F89BF8FE1A6B593

Enctype: camellia128-cts-cmac
Key: 866E0466A178279A32AC0BDA92B72AEB
Input: (empty string)
Output: 97FBB354BF341C3A160DCC86A7A910FDA824601DF677
        68797BACEEBF5D250AE929DEC9760772084267F50A54

Enctype: camellia128-cts-cmac
Key: D4893FD37DA1A211E12DD1E03E0F03B7
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: 1DEE2FF126CA563A2A2326B9DD3F0095013257414C83
        FAD4398901013D55F367C82681186B7B2FE62F746BA4

Enctype: camellia256-cts-cmac
Key: 203071B1AE77BD3D6FCE70174AF95C225B1CED46B35CF52B6479EFEB47E6B063
Input: (empty string)
Output: 9B30020634C10FDA28420CEE7B96B70A90A771CED43A
        D8346554163E5949CBAE2FB8EF36AFB6B32CE75116A0

Enctype: camellia256-cts-cmac
Key: A171AD582C1AFBBAD52ABD622EE6B6A14D19BF95C6914B2BA40FFD99A88EC660
Input: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz123456789
Output: A47CBB6E104DCC77E4DB48A7A474B977F2FB6A7A1AB6
        52317D50508AE72B7BE2E4E4BA24164E029CBACF786B

Acknowledgements 🫶

so this doc is an update to RFC 4402, which Nico Williams wrote 👑 and Greg Hudson is the one who provided the test vectors based on MIT's implementation 💜 huge thanks to both of them, they're literally the reason this is complete 🌸

Authors' Addresses 💌

the authors are Shawn Emery and Nicolas Williams, here's where you can reach them 🦋

Shawn Emery
Oracle Corporation
500 Eldorado Blvd Bldg 1
Broomfield, CO  78727
United States

EMail: shawn.emery@oracle.com


Nicolas Williams
Cryptonector, LLC

EMail: nico@cryptonector.com

that's the whole thing, bestie! 🌈✨ you did it 💖

📦 where this page comes from

ietf: rfc7802 2016-03
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms