1. Summary
Matt Rogers is the document shepherd. Stephen Farrell is the
responsible Area Director.
This document describes the Public Key Cryptography for Initial
Authentication in Kerberos (PKINIT) Freshness Extension. This extension
allows the KDC to add a “freshness token” to the PKINIT exchange that
allows the client to prove current possession of its secret key.
This is a Standards Track document to extend PKINIT (RFC 4556) for the
purpose of correcting a flaw with the PKINIT Diffie-Hellman key
exchange method.
2. Review and Consensus
There is strong consensus for this document, and is the result of
active discussion and review among WG members and implementers. There
were two main discussion topics that formed this document. The first
regarded the choice to specify the freshness token contents as KDC
implementation-defined. The token is an element that is both generated
and used by the KDC only, being opaque to the client. While there is
sometimes the need to have interoperability between KDC-only formats
within a realm, there is a precedence within the WG to not standardize
these and let the implementations supply documentation on their
formats. The other topic was regarding the pre-authentication error
code and handling; The initial choice of KDC_ERR_PREAUTH_FAILED was
decided as unsuitable for a retriable error and was changed to
KDC_ERR_PREAUTH_EXPIRED defined in RFC 6113.
3. Intellectual Property
There are no intellectual property disclosures against this document,
and all authors have confirmed compliance with BCPs 78 and 79.
4. Other Information
There is an IANA request for the PA_AS_FRESHNESS value of 150 to be
added to Kerberos Parameters: Pre-authentication and Typed Data
registry.
There are a few idnits that show up for the document that were
discussed, and could be left up to notes for the RFC Editor:
https://mailarchive.ietf.org/arch/msg/kitten/EUPGA51nqX3i6RVb0vNvOqwo9i
k