RFC 6113 on A Generalized Framework for Kerberos Pre-Authentication

A new Request for Comments is now available in online RFC libraries.

        RFC 6113

        Title:      A Generalized Framework for Kerberos 
                    Pre-Authentication 
        Author:     S. Hartman, L. Zhu
        Status:     Standards Track
        Stream:     IETF
        Date:       April 2011
        Mailbox:    hartmans-ietf@mit.edu, 
                    larry.zhu@microsoft.com
        Pages:      48
        Characters: 121122
        Updates:    RFC4120

        I-D Tag:    draft-ietf-krb-wg-preauth-framework-17.txt

        URL:        http://www.rfc-editor.org/rfc/rfc6113.txt

Kerberos is a protocol for verifying the identity of principals
(e.g., a workstation user or a network server) on an open network.
The Kerberos protocol provides a facility called pre-authentication.
Pre-authentication mechanisms can use this facility to extend the
Kerberos protocol and prove the identity of a principal.

This document describes a more formal model for this facility.  The
model describes what state in the Kerberos request a
pre-authentication mechanism is likely to change.  It also describes
how multiple pre-authentication mechanisms used in the same request
will interact.

This document also provides common tools needed by multiple
pre-authentication mechanisms.  One of these tools is a secure channel
between the client and the key distribution center with a reply key
strengthening mechanism; this secure channel can be used to protect
the authentication exchange and thus eliminate offline dictionary
attacks.  With these tools, it is relatively straightforward to chain
multiple authentication mechanisms, utilize a different key management
system, or support a new key agreement algorithm.  [STANDARDS-TRACK]

This document is a product of the Kerberos WG Working Group of the IETF.

This is now a Proposed Standard Protocol.

STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements.  Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol.  Distribution of this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  http://www.ietf.org/mailman/listinfo/ietf-announce
  http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC