Problem Statement on the Cross-Realm Operation of Kerberos
RFC 5868

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 06

Internet Engineering Task Force (IETF)                         S. Sakane
Request for Comments: 5868                                     K. Kamada
Category: Informational                                        S. Zrelli
ISSN: 2070-1721                                  Yokogawa Electric Corp.
                                                             M. Ishiyama
                                                           Toshiba Corp.
                                                                May 2010

       Problem Statement on the Cross-Realm Operation of Kerberos

Abstract

   This document provides background information regarding large-scale
   Kerberos deployments in the industrial sector, with the aim of
   identifying issues in the current Kerberos cross-realm authentication
   model as defined in RFC 4120.

   This document describes some examples of actual large-scale
   industrial systems, and lists requirements and restrictions regarding
   authentication operations in such environments.  It also identifies a
   number of requirements derived from the industrial automation field.
   Although they are found in the field of industrial automation, these
   requirements are general enough and are applicable to the problem of
   Kerberos cross-realm operations.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc5868.

Sakane, et al.                Informational                     [Page 1]
RFC 5868    Kerberos Cross-Realm Operation Problem Statement    May 2010

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1. Introduction ....................................................3
   2. Kerberos System .................................................4
      2.1. Kerberos Basic Operation ...................................4
      2.2. Cross-Realm Operation ......................................4
   3. Applying Cross-Realm Kerberos in Complex Environments ...........5
   4. Requirements ....................................................7
   5. Issues ..........................................................8
      5.1. Unreliability of Authentication Chain ......................8
      5.2. Possibility of MITM in the Indirect Trust Model ............8
      5.3. Scalability of the Direct Trust Model ......................9
      5.4. Exposure to DoS Attacks ....................................9
      5.5. Client's Performance ......................................10
      5.6. Kerberos Pre-Authentication Problem in Roaming Scenarios ..10
   6. Implementation Considerations ..................................11
   7. Security Considerations ........................................11
   8. Acknowledgements ...............................................11
   9. References .....................................................11
      9.1. Normative References ......................................11
      9.2. Informative References ....................................11

Sakane, et al.                Informational                     [Page 2]
RFC 5868    Kerberos Cross-Realm Operation Problem Statement    May 2010

1.  Introduction

   Kerberos Version 5 is a widely deployed mechanism that enables a
   server to authenticate a client before granting it access to a
   certain service.  Each client belongs to a managed domain called a
   realm.  Kerberos supports authentication when a client and a server
   belong to different realms.  This is called cross-realm
   authentication.

   There exist several ways for using Kerberos in large-scale
   distributed systems.  Such infrastructures are typically split into
   several managed domains for geographical reasons, and to implement
   different management policies.  In order to ensure smooth network