Skip to main content

Deriving Keys From TLS for Kerberos V5
draft-josefsson-krb5starttls-bootstrap-02

Document Type Expired Internet-Draft (individual)
Expired & archived
Author Simon Josefsson
Last updated 2009-03-06
RFC stream (None)
Intended RFC status (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:

Abstract

This document describes how clients can use the Kerberos V5 over TLS protocol together with its long term key to 1) avoid having to validate the server certificate, 2) securely learn a KDC's server certificate, and 3) learn the trust anchors used by the KDC. We also describe how the Kerberos V5 over TLS protocol can be used to 4) avoid the need for a long term shared key between the client and the KDC by instead using TLS client authentication. These goals are achieved by introducing a new Kerberos V5 pre- authentication type that modify how the Kerberos V5 reply key is derived.

Authors

Simon Josefsson

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)