[2545] in Kerberos
New message type for V5 spec
daemon@ATHENA.MIT.EDU (Clifford Neuman)
Wed Feb 3 19:07:06 1993
Date: Wed, 3 Feb 93 15:23:38 PST
From: Clifford Neuman <bcn@ISI.EDU>
To: kerberos@MIT.EDU
A few weeks ago I sent a proposed message format for a protocol
message to be used to forward Kerberos credentials for telnet and
rlogin. In making the changes to the code, it because clear that the
message format did not support the transfer of information about the
ticket needed for the remote ticket file. Here is a revised message
format, with all the meta information added as optional fields.
As I indicated in the previous message, it is worthwhile to define
this message in general so that applications needing to forward
credentials will do it right (that I forgot some necessary fields
demonstrates how easy it is to get it wrong). Please provide feedback
on the proposed format:
KRB-CRED ::= [APPLICATION 22] SEQUENCE {
pvno[0] INTEGER,
msg-type[1] INTEGER, -- KRB_CRED
ticket[2] Ticket,
enc-part[3] EncryptedData
}
EncKrbCredPart ::= [APPLICATION 29] SEQUENCE {
key[0] EncryptionKey,
nonce[1] INTEGER OPTIONAL,
timestamp[2] KerberosTime,
usec[3] INTEGER,
s-address[4] HostAddress OPTIONAL,
r-address[5] HostAddress OPTIONAL
prealm[6] Realm OPTIONAL,
pname[7] PrincipalName OPTIONAL,
flags[8] TicketFlags OPTIONAL,
authtime[9] KerberosTime OPTIONAL,
starttime[10] KerberosTime OPTIONAL,
endtime[11] KerberosTime OPTIONAL
renew-till[12] KerberosTime OPTIONAL,
srealm[13] Realm OPTIONAL,
sname[14] PrincipalName OPTIONAL,
caddr[15] HostAddresses OPTIONAL
}
An application code in the encrypted part of a message provides an
additional check that the message was decrypted properly.
pvno and msg-type
These fields are described above in section 5.4.1.
msg-type is KRB_CRED.
ticket
This is the ticket obtained from the KDC specifically forwarding
to the intended recipient.
enc-part
This field holds an encoding of the EncKrbCredPart sequence
encrypted under the session key shared between the sender and the
intended recipient. This encrypted encoding is used for the enc-part
field of the KRB-CRED message. See section 6 for the format of
the ciphertext.
key
This field exists in the ticket and is used to pass the session
key from the sender to the intended recipient. The fields
encoding is described in section 6.1.
nonce
If practical an application may require the inclusion of a nonce
generated by the recipient. If the same number is included in the
message, it provides evidence that the response is fresh and has not
been replayed by an attacker. A nonce must never be re-used. Ideally,
it should be generated randomly
timestamp, usec, s-address and address
These fields are described above in section 5.6.1
The following fields are optional. If present, they can be associated
with the credentials in the remote ticket file. If left out, then it
is assumed that the recipient of the credentials already knows how to
use them.
prealm, pnname
The name and realm of the delegated principal identity.
flags, authtime, starttime, endtime, renew-till, srealm, sname, caddr
These fields contain the values of the corresponding fields in the
ticket found in the ticket field. Descriptions of the fields are
identical to the descriptions in the KDC-REP message.
