draft-ietf-kitten-krb5-gssapi-prf-02.txt   draft-ietf-kitten-krb5-gssapi-prf-03.txt 
NETWORK WORKING GROUP N. Williams NETWORK WORKING GROUP N. Williams
Internet-Draft Sun Internet-Draft Sun
Expires: December 30, 2004 July 2004 Expires: November 13, 2005 May 12, 2005
A PRF for the Kerberos V GSS-API Mechanism A PRF for the Kerberos V GSS-API Mechanism
draft-ietf-kitten-krb5-gssapi-prf-02.txt draft-ietf-kitten-krb5-gssapi-prf-03.txt
Status of this Memo Status of this Memo
By submitting this Internet-Draft, I certify that any applicable By submitting this Internet-Draft, each author represents that any
patent or other IPR claims of which I am aware have been disclosed, applicable patent or other IPR claims of which he or she is aware
and any of which I become aware will be disclosed, in accordance with have been or will be disclosed, and any of which he or she becomes
RFC 3668. aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as other groups may also distribute working documents as Internet-
Internet-Drafts. Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt. http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on December 30, 2004. This Internet-Draft will expire on November 13, 2005.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved. Copyright (C) The Internet Society (2005).
Abstract Abstract
This document defines the Pseudo-Random Function (PRF) for the This document defines the Pseudo-Random Function (PRF) for the
Kerberos V mechanism for the Generic Security Service Application Kerberos V mechanism for the Generic Security Service Application
Programming Interface (GSS-API), based on the PRF defined for the Programming Interface (GSS-API), based on the PRF defined for the
Kerberos V cryptographic framework, for keying application protocols Kerberos V cryptographic framework, for keying application protocols
given an established Kerberos V GSS-API security context. given an established Kerberos V GSS-API security context.
Table of Contents Table of Contents
1. Conventions used in this document . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Kerberos V GSS Mechanism PRF . . . . . . . . . . . . . . . . . . 4 1.1 Conventions used in this document . . . . . . . . . . . . . . 3
3. Security Considerations . . . . . . . . . . . . . . . . . . . . 5 2. Kerberos V GSS Mechanism PRF . . . . . . . . . . . . . . . . . 3
4. Normative References . . . . . . . . . . . . . . . . . . . . . . 5 3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 5 4. Security Considerations . . . . . . . . . . . . . . . . . . . 4
Intellectual Property and Copyright Statements . . . . . . . . . 7 5. Normative References . . . . . . . . . . . . . . . . . . . . . 5
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 5
Intellectual Property and Copyright Statements . . . . . . . . 6
1. Conventions used in this document 1. Introduction
This document specifies the Kerberos V GSS-API mechanism's pseudo-
random function corresponding to [GSS-PRF]. The function is a "PRF+"
style construction.
1.1 Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
2. Kerberos V GSS Mechanism PRF 2. Kerberos V GSS Mechanism PRF
The GSS-API PRF [GSS-PRF] function for the Kerberos V mechanism [CFX] The GSS-API PRF [GSS-PRF] function for the Kerberos V mechanism
shall be the output of a PRF+ function based on the enctype's PRF [RFC1964] shall be the output of a PRF+ function based on the
function keyed with the negotiated session key of the security encryption type's PRF function keyed with the negotiated session key
context and key usage X (TBD). of the security context corresponding to the 'prf_key' input
parameter of GSS_Pseudo_random().
The security context MUST be fully established, else the mechanism This PRF+ MUST be keyed with the key indicated by the 'prf_key' input
MUST fail with GSS_S_UNAVAILABLE as the major status code and parameter as follows:
GSS_KRB5_S_KG_CTX_INCOMPLETE as the minor status code.
This PRF+ MUST be keyed with a key derived, with key usage (TBD), o GSS_C_PRF_KEY_FULL -- use the sub-session key asserted by the
from the session used by the initiator and acceptor, after the acceptor, if any, or the sub-session asserted by the initiator, if
security context is fully established, to derive keys for per-message any, or the Ticket's session key
tokens. For the current Kerberos V mechanism [CFX] this means that
the PRF+ MUST be keyed with the acceptor-asserted subkey, if it did o GSS_C_PRF_KEY_PARTIAL -- use the sub-session key asserted by the
assert such a key, or the initiator's sub-session key otherwise. initiator, if any, or the Ticket's session key
The PRF+ function is a simple counter-based extension of the Kerberos The PRF+ function is a simple counter-based extension of the Kerberos
V pseudo-random function [KRB5-CRYPTO] for the enctype of the V pseudo-random function [RFC3961] for the encryption type of the
security context's keys: security context's keys:
PRF+(K, L, S) = truncate(L, T1 || T2 || .. || Tn) PRF+(K, L, S) = truncate(L, T1 || T2 || .. || Tn)
Tn = pseudo-random-function(K, n || S) Tn = pseudo-random(K, n || S)
where '||' is the concatenation operator, 'n' is encoded as a where '||' is the concatenation operator, 'n' is encoded as a network
network byte order 32-bit unsigned binary number, and where byte order 32-bit unsigned binary number, truncate(L, S) truncates
truncate(L, S) truncates the input octet string S to length L. the input octet string S to length L, and pseudo-random() is the
Kerberos V pseudo-random function [RFC3961].
The maximum output size of the Kerberos V mechanism's GSS-API PRF The maximum output size of the Kerberos V mechanism's GSS-API PRF
then is, necessarily, 2^32 octets. then is, necessarily, 2^32 times the output size of the pseudo-
random() function for the encryption type of the given key.
Implementations MUST support output size of up to 2^14 octets at When the input size is longer than 2^14 octets as per [GSS-PRF] and
least. exceeds an implementation's resources then the mechanism MUST return
GSS_S_FAILURE and GSS_KRB5_S_KG_INPUT_TOO_LONG as the minor status
code.
If the implementation cannot produce the desired output then it MUST 3. IANA Considerations
output what it can.
The minimum input octet string length that implementations MUST This document has no IANA considerations currently. If and when a
support is also 2^14 octets. If the input octet string is longer relevant IANA registry of GSS-API symbols and constants is created
than the maximum that an implementation can process then the then the GSS_KRB5_S_KG_INPUT_TOO_LONG minor status code should be
implementation MUST fail with GSS_S_FAILURE as the major status code added to such a registry.
and GSS_KRB5_S_KG_INPUT_TOO_LONG as the minor status code.
3. Security Considerations 4. Security Considerations
Kerberos V enctypes' PRF functions use a key derived from contexts' Kerberos V encryption types' PRF functions use a key derived from
session keys and should preserve the forward security properties of contexts' session keys and should preserve the forward security
the mechanisms' key exchanges. properties of the mechanisms' key exchanges.
Legacy Kerberos V enctypes may be weak, particularly the single-DES Legacy Kerberos V encryption types may be weak, particularly the
enctypes. single-DES encryption types.
See also [GSS-PRF] for generic security considerations of See also [GSS-PRF] for generic security considerations of
GSS_Pseudo_random(). GSS_Pseudo_random().
See also [RFC3961] for generic security considerations of the
Kerberos V cryptographic framework.
Care should be taken not to exceed the useful lifetime of an
established security context's session key's useful lifetime as
implementations are not required to prevent overuse of the
GSS_Pseudo_random() function. This can effectively be achieved by
limiting the number of GSS_Pseudo_random() calls to, say, a handful
of calls per-security context.
Use of Ticket session keys, rather than sub-session keys, when
initiators and acceptors fail to assert sub-session keys, is
dangerous as ticket reuse can lead to key reuse, therefore initiators
should assert sub-session keys always, and acceptors should assert
sub-session keys at least when initiators fail to do so..
The computational cost of computing this PRF+ may vary depending on The computational cost of computing this PRF+ may vary depending on
the Kerberos V enctypes being used, but generally the computation of the Kerberos V encryption types being used, but generally the
this PRF+ gets more expensive as the input and output octet string computation of this PRF+ gets more expensive as the input and output
lengths grow (note that the use of a counter in the PRF+ construction octet string lengths grow (note that the use of a counter in the PRF+
allows for parallelization). This means that if an application can construction allows for parallelization). This means that if an
be tricked into providing very large input octet strings and application can be tricked into providing very large input octet
requesting very long output octet strings then that may constitue a strings and requesting very long output octet strings then that may
denial of service attack on the application; therefore applications constitute a denial of service attack on the application; therefore
SHOULD place appropriate limits on the size of any input octet applications SHOULD place appropriate limits on the size of any input
strings received from their peers without integrity protection. octet strings received from their peers without integrity protection.
4 Normative References 5. Normative References
[CFX] Zhu, L., Jaganathan, K. and S. Hartman, "The Kerberos [CFX] Zhu, L., Jaganathan, K., and S. Hartman, "The Kerberos
Version 5 GSS-API Mechanism: Version 2". Version 5 GSS-API Mechanism: Version 2".
[GSS-PRF] Williams, N., "A PRF API extension for the GSS-API". [GSS-PRF] Williams, N., "A PRF API extension for the GSS-API".
[KRB5-CRYPTO] [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism",
Raeburn, K., "Encryption and Checksum Specifications for RFC 1964, June 1996.
Kerberos 5".
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2743] Linn, J., "Generic Security Service Application Program [RFC2743] Linn, J., "Generic Security Service Application Program
Interface Version 2, Update 1", RFC 2743, January 2000. Interface Version 2, Update 1", RFC 2743, January 2000.
[RFC2744] Wray, J., "Generic Security Service API Version 2 : [RFC2744] Wray, J., "Generic Security Service API Version 2 :
C-bindings", RFC 2744, January 2000. C-bindings", RFC 2744, January 2000.
[RFC3961] Raeburn, K., "Encryption and Checksum Specifications for
Kerberos 5", RFC 3961, February 2005.
Author's Address Author's Address
Nicolas Williams Nicolas Williams
Sun Microsystems Sun Microsystems
5300 Riata Trace Ct 5300 Riata Trace Ct
Austin, TX 78727 Austin, TX 78727
US US
EMail: Nicolas.Williams@sun.com Email: Nicolas.Williams@sun.com
Intellectual Property Statement Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be on the procedures with respect to rights in RFC documents can be
skipping to change at page 7, line 41 skipping to change at page 6, line 41
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement Copyright Statement
Copyright (C) The Internet Society (2004). This document is subject Copyright (C) The Internet Society (2005). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights. except as set forth therein, the authors retain all their rights.
Acknowledgment Acknowledgment
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/