The Kerberos Version 5 GSS-API Mechanism
updated by
Extracted elements (28)
Checksums in both MIC and Wrap tokens are computed over the data logically prepended by the first 8 bytes of the plaintext packet header. This binds the integrity check to the token type, protocol version, and algorithm identifier fields, preventing a valid checksum from being reused in a different token context.
The GSS-API framing from RFC-1508 Appendix B is applied to all emitted tokens — KRB_AP_REQ, KRB_AP_REP, KRB_ERROR, context-deletion, and per-message tokens — not only the initial token. While not required by RFC-1508, this enables implementations to perform enhanced error-checking.
The DES-MAC integrity algorithm (SGN_ALG=02 00) may not be present in all implementations. The spec notes this explicitly for both MIC and Wrap contexts, implying implementations must be prepared to handle peers that do not support it.
All implementations shall be capable of accepting buffers of at least 16 Kbytes as input to GSS_GetMIC(), GSS_VerifyMIC(), and GSS_Wrap(), and shall accept the output_token generated by GSS_Wrap() for a 16 Kbyte input buffer as input to GSS_Unwrap(). Support for larger buffer sizes is optional but recommended.
If the caller passes GSS_C_NO_BINDINGS instead of a valid channel bindings structure, the Bnd field shall be set to 16 zero-valued bytes.
Per-message replay and out-of-sequence detection are optional. Implementations offering these services should honor a caller's request to disable them: if replay_det_req_flag is FALSE, replay_det_state should be returned FALSE and GSS_DUPLICATE_TOKEN/GSS_OLD_TOKEN should not be indicated.
The optional seq-number element within the AP-REP's EncAPRepPart shall be included when mutual authentication is performed.
When source address channel binding values are provided and the received token bears address restrictions, it is recommended that the implementation check that the source address matches and return GSS_S_BAD_BINDINGS if a mismatch is detected.
Delegation is conveyed by an optional KRB_CRED message in the authenticator checksum (bytes 24+: DlgOpt=1, Dlgth, Deleg). Delegation is active only when a TGT with its FORWARDABLE flag set is transferred within the KRB_CRED message.
Initiating credentials consist of a TGT plus session key stored in a credentials cache. Accepting credentials are service keys in a key table. When initiating credentials for a service principal are absent from the cache but a service key is available, the mechanism should use the service key to obtain a TGT from the KDC.
QOP integrity values for GSS_GetMIC()/GSS_Wrap(): GSS_KRB5_INTEG_C_QOP_MD5=1 (MD2.5), GSS_KRB5_INTEG_C_QOP_DES_MD5=2 (DES MAC of MD5), GSS_KRB5_INTEG_C_QOP_DES_MAC=3. Confidentiality: GSS_KRB5_CONF_C_QOP_DES=0 (DES). Non-overlapping bit positions allow combined integrity and confidentiality selection via inclusive-OR.
The confidentiality key for Wrap token DES-CBC encryption is derived by XOR-ing the context key with the constant f0f0f0f0f0f0f0f0. The MD2.5 seed key is derived by byte-reversing the context key. The context key is the Kerberos session key or subkey if present in the authenticator.
The Exported Name Object Form for Kerberos V5 is required for GSS_Export_name() in GSS-API Version 2. For distinguished encoding, all '@', '/', and '\' characters in principal components and realm names must be quoted, and control characters (null, backspace, tab, newline) must be represented with escape sequences.
The Host-Based Service Name Form (OID ...generic(1) service_name(4), symbolic GSS_C_NT_HOSTBASED_SERVICE) takes the form 'service@hostname'. The hostname is canonicalized via DNS to its fully-qualified domain name in lowercase; the hostname element may be omitted, defaulting to the local host's canonicalized name.
The Kerberos Principal Name Form (OID ...krb5_name(1), symbolic GSS_KRB5_NT_PRINCIPAL_NAME) is a mandatory name type representing a single-string Kerberos name. Components are separated by '/', a realm follows '@', and special characters including '@', '/', and '\' must be quoted with a preceding backslash.
The Kerberos V5 GSS-API mechanism is identified by the OID {iso(1) member-body(2) United States(840) mit(113554) infosys(1) gssapi(2) krb5(2)} upon advancement to Proposed Standard. Prior to that, the interim OID {iso(1), org(3), dod(5), internet(1), security(5), kerberosv5(2)} was used for experimentation.
Three integrity algorithms are defined: DES MAC MD5 (MD5 hash of plaintext, then DES-CBC MAC on 16-byte result), MD2.5 (byte-reversed-key DES-CBC seed prepended to data, then MD5 with first 8 bytes stored), and DES MAC (direct 64-bit DES-CBC MAC on plaintext). Support for DES MAC may not be present in all implementations.
Values for the 'service' element of the Host-Based Service Name Form will be registered with IANA. This registry supports implementations mapping service names to Kerberos service principals.
MD2.5 has received limited evaluation and an initial assessment suggests it may be significantly weaker than DES MAC MD5. The algorithm intentionally uses only 8 of 16 MD5 output bytes to guard against postfix attacks where data is appended to an existing message with corresponding checksum modification.
The direction indicator (four bytes of 0x00 or 0xFF) within the sequence number provides redundancy to verify successful DES decryption and detects maliciously reflected packets. Using SGN_CKSUM as the IV for sequence number decryption ensures that splicing a checksum and sequence number from different messages will be detected.
All GSS-API tokens use an InitialContextToken framing: [APPLICATION 0] IMPLICIT SEQUENCE containing a MechType OID and an innerContextToken. Context establishment tokens carry a 2-byte TOK_ID field: 01 00 for KRB_AP_REQ, 02 00 for KRB_AP_REP, 03 00 for KRB_ERROR.
Context deletion tokens (TOK_ID 01 02) use the same 24-byte layout as MIC tokens. The SGN_CKSUM is computed as for GSS_GetMIC() but with a zero-length user-data component.
MIC tokens (TOK_ID 01 01) have a 24-byte structure: TOK_ID (2 bytes), SGN_ALG (2 bytes: 00 00=DES MAC MD5, 01 00=MD2.5, 02 00=DES MAC), Filler (4 bytes, ff ff ff ff), SND_SEQ (8 bytes, encrypted sequence number), SGN_CKSUM (8 bytes).
The 8-byte plaintext sequence number field encodes the sender's 4-byte sequence number (s0..s3, least to most significant) followed by four repetitions of the direction indicator (0x00=initiator, 0xFF=acceptor). The field is DES-CBC encrypted using the context key with an IV taken from the first 8 bytes of SGN_CKSUM.
The Flags field (bytes 20-23 of the authenticator checksum) encodes context-establishment flags in little-endian form: GSS_C_DELEG_FLAG=1, GSS_C_MUTUAL_FLAG=2, GSS_C_REPLAY_FLAG=4, GSS_C_SEQUENCE_FLAG=8, GSS_C_CONF_FLAG=16, GSS_C_INTEG_FLAG=32.
The KRB_AP_REQ authenticator carries a checksum of type 0x8003 with a value field of at least 24 bytes: Lgth (bytes 0-3, little-endian 16), Bnd (bytes 4-19, MD5 hash of channel bindings), Flags (bytes 20-23, little-endian bit vector). Optional delegation fields DlgOpt/Dlgth/Deleg extend the field beyond 24 bytes.
Wrap token plaintext is padded to the next multiple of 8 bytes by appending 1-8 bytes each containing the total pad count, and an 8-byte random confounder is prepended before encryption. DES-CBC encryption uses the derived confidentiality key and a zero IV.
Wrap tokens (TOK_ID 02 01) extend the MIC header format with SEAL_ALG at bytes 4-5 (ff ff=no encryption, 00 00=DES) and Filler at bytes 6-7, followed by SND_SEQ (8 bytes), SGN_CKSUM (8 bytes), and the encrypted or plaintext padded data payload.