Problem Statement on the Cross-Realm Operation of Kerberos
RFC 5868
Internet Engineering Task Force (IETF) S. Sakane
Request for Comments: 5868 K. Kamada
Category: Informational S. Zrelli
ISSN: 2070-1721 Yokogawa Electric Corp.
M. Ishiyama
Toshiba Corp.
May 2010
Problem Statement on the Cross-Realm Operation of Kerberos
Abstract
This document provides background information regarding large-scale
Kerberos deployments in the industrial sector, with the aim of
identifying issues in the current Kerberos cross-realm authentication
model as defined in RFC 4120.
This document describes some examples of actual large-scale
industrial systems, and lists requirements and restrictions regarding
authentication operations in such environments. It also identifies a
number of requirements derived from the industrial automation field.
Although they are found in the field of industrial automation, these
requirements are general enough and are applicable to the problem of
Kerberos cross-realm operations.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc5868.
Sakane, et al. Informational [Page 1]
RFC 5868 Kerberos Cross-Realm Operation Problem Statement May 2010
Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
2. Kerberos System .................................................4
2.1. Kerberos Basic Operation ...................................4
2.2. Cross-Realm Operation ......................................4
3. Applying Cross-Realm Kerberos in Complex Environments ...........5
4. Requirements ....................................................7
5. Issues ..........................................................8
5.1. Unreliability of Authentication Chain ......................8
5.2. Possibility of MITM in the Indirect Trust Model ............8
5.3. Scalability of the Direct Trust Model ......................9
5.4. Exposure to DoS Attacks ....................................9
5.5. Client's Performance ......................................10
5.6. Kerberos Pre-Authentication Problem in Roaming Scenarios ..10
6. Implementation Considerations ..................................11
7. Security Considerations ........................................11
8. Acknowledgements ...............................................11
9. References .....................................................11
9.1. Normative References ......................................11
9.2. Informative References ....................................11
Sakane, et al. Informational [Page 2]
RFC 5868 Kerberos Cross-Realm Operation Problem Statement May 2010
1. Introduction
Kerberos Version 5 is a widely deployed mechanism that enables a
server to authenticate a client before granting it access to a
certain service. Each client belongs to a managed domain called a
realm. Kerberos supports authentication when a client and a server
belong to different realms. This is called cross-realm
authentication.
There exist several ways for using Kerberos in large-scale
distributed systems. Such infrastructures are typically split into
several managed domains for geographical reasons, and to implement
different management policies. In order to ensure smooth network
Show full document text