The Kerberos Network Authentication Service (V5)
RFC 1510

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 02

Network Working Group                                            J. Kohl
Request for Comments: 1510                 Digital Equipment Corporation
                                                               C. Neuman
                                                                     ISI
                                                          September 1993

            The Kerberos Network Authentication Service (V5)

Status of this Memo

   This RFC specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" for the standardization state and status
   of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document gives an overview and specification of Version 5 of the
   protocol for the Kerberos network authentication system. Version 4,
   described elsewhere [1,2], is presently in production use at MIT's
   Project Athena, and at other Internet sites.

Overview

   Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos,
   Moira, and Zephyr are trademarks of the Massachusetts Institute of
   Technology (MIT).  No commercial use of these trademarks may be made
   without prior written permission of MIT.

   This RFC describes the concepts and model upon which the Kerberos
   network authentication system is based. It also specifies Version 5
   of the Kerberos protocol.

   The motivations, goals, assumptions, and rationale behind most design
   decisions are treated cursorily; for Version 4 they are fully
   described in the Kerberos portion of the Athena Technical Plan [1].
   The protocols are under review, and are not being submitted for
   consideration as an Internet standard at this time.  Comments are
   encouraged.  Requests for addition to an electronic mailing list for
   discussion of Kerberos, kerberos@MIT.EDU, may be addressed to
   kerberos-request@MIT.EDU.  This mailing list is gatewayed onto the
   Usenet as the group comp.protocols.kerberos.  Requests for further
   information, including documents and code availability, may be sent
   to info-kerberos@MIT.EDU.

Kohl & Neuman                                                   [Page 1]
RFC 1510                        Kerberos                  September 1993

Background

   The Kerberos model is based in part on Needham and Schroeder's
   trusted third-party authentication protocol [3] and on modifications
   suggested by Denning and Sacco [4].  The original design and
   implementation of Kerberos Versions 1 through 4 was the work of two
   former Project Athena staff members, Steve Miller of Digital
   Equipment Corporation and Clifford Neuman (now at the Information
   Sciences Institute of the University of Southern California), along
   with Jerome Saltzer, Technical Director of Project Athena, and
   Jeffrey Schiller, MIT Campus Network Manager.  Many other members of
   Project Athena have also contributed to the work on Kerberos.
   Version 4 is publicly available, and has seen wide use across the
   Internet.

   Version 5 (described in this document) has evolved from Version 4
   based on new requirements and desires for features not available in
   Version 4.  Details on the differences between Kerberos Versions 4
   and 5 can be found in [5].

Table of Contents

   1. Introduction .......................................    5
   1.1. Cross-Realm Operation ............................    7
   1.2. Environmental assumptions ........................    8
   1.3. Glossary of terms ................................    9
   2. Ticket flag uses and requests ......................   12
   2.1. Initial and pre-authenticated tickets ............   12
   2.2. Invalid tickets ..................................   12
   2.3. Renewable tickets ................................   12
   2.4. Postdated tickets ................................   13
   2.5. Proxiable and proxy tickets ......................   14
   2.6. Forwardable tickets ..............................   15
   2.7. Other KDC options ................................   15
   3. Message Exchanges ..................................   16
   3.1. The Authentication Service Exchange ..............   16
   3.1.1. Generation of KRB_AS_REQ message ...............   17
   3.1.2. Receipt of KRB_AS_REQ message ..................   17
   3.1.3. Generation of KRB_AS_REP message ...............   17
   3.1.4. Generation of KRB_ERROR message ................   19
   3.1.5. Receipt of KRB_AS_REP message ..................   19
   3.1.6. Receipt of KRB_ERROR message ...................   20
   3.2. The Client/Server Authentication Exchange ........   20
   3.2.1. The KRB_AP_REQ message .........................   20
   3.2.2. Generation of a KRB_AP_REQ message .............   20
   3.2.3. Receipt of KRB_AP_REQ message ..................   21
   3.2.4. Generation of a KRB_AP_REP message .............   23