Projects/GSS-API preauth - Revision history

Aperez: /* Statelessness */

2012-09-07T09:44:12Z

‎Statelessness

Aperez: /* GSS-API credentials */

2012-08-24T13:11:00Z

‎GSS-API credentials

Aperez: Undo revision 4812 by Aperez (Talk)

2012-08-24T07:57:20Z

Undo revision 4812 by Aperez (Talk)

Aperez: /* Statelessness */

2012-08-24T07:54:42Z

‎Statelessness

Aperez: /* Statelessness */

2012-08-22T11:02:04Z

‎Statelessness

Aperez at 11:13, 20 August 2012

2012-08-20T11:13:00Z

Aperez: /* Allowed GSS-API mechanisms */

2012-08-20T09:04:48Z

‎Allowed GSS-API mechanisms

Aperez at 09:03, 20 August 2012

2012-08-20T09:03:55Z

Aperez: /* Statelessness */

2012-08-10T07:48:13Z

‎Statelessness

Aperez: /* Requirements */

2012-08-10T07:47:49Z

‎Requirements

@@ Line 65: / Line 65: @@
+}
  </nowiki>
-state-kvno and state-cookie would be absent on first AS_REQ and last AS_REP messages.
+state would be absent on first AS_REQ and last AS_REP messages. It would be encrypted with the first krbtgt key, using a key usage in the 512-1023 range.
 == Reply key generation ==

@@ Line 81: / Line 81: @@
 # If the client wanted to use the default credentials for the GSS mechanism, he could use another pre-auth option (e.g. -X gss_default) to indicated that NULL MUST be used as client name to acquire the initial credentials. Note that in this case, the provided cname will be still being used as the cname in the AS_REQ message.
-For instance, to execute a GSS-EAP authentication with default credentials (for example, to lauch the moonshot's identity selector), both options should be indicated.
+For instance, to execute a federated GSS-EAP authentication with default credentials (for example, to launch the moonshot's identity selector), both options should be indicated.
 If -X gss_federated is not used, the returned textual representation of the GSS name MUST be identical to the cname provided in AS_REQ, excluding the realm part.
 == Allowed GSS-API mechanisms ==

@@ Line 56: / Line 56: @@
 PA-GSS ::= SEQUENCE {
      sec-ctx-token [0] OCTET STRING,
-     enc-state [1] EncryptedData OPTIONAL -- containing PA-GSS-STATE
+     state [1] EncryptedData OPTIONAL -- containing PA-GSS-STATE
+}

@@ Line 56: / Line 56: @@
 PA-GSS ::= SEQUENCE {
      sec-ctx-token [0] OCTET STRING,
-     state [1] EncryptedData OPTIONAL -- containing PA-GSS-STATE
+     enc-state [1] EncryptedData OPTIONAL -- containing PA-GSS-STATE
+}

@@ Line 60: / Line 60: @@
 PA-GSS-STATE ::= SEQUENCE {
-     timestamp [0] KerberosTime OPTIONAL,
+     timestamp [0] KerberosTime,
-     exported-sec-ctx-token [1] OCTET STRING OPTIONAL,
+     exported-sec-ctx-token [1] OCTET STRING,
      ...
+}

← Older revision		Revision as of 11:13, 20 August 2012
Line 96:		Line 96:
	## GSS_C_SEQUENCE_FLAG		## GSS_C_SEQUENCE_FLAG
	## GSS_C_TRANS_FLAG (only on the KDC)		## GSS_C_TRANS_FLAG (only on the KDC)
		+
		+	== Ticket timestamps ==
		+	Default ticket expiration and renewal times are updated if time_rec is not GSS_C_INDEFINITE. In particular
		+	* enc_tkt_reply->times.endtime = enc_tkt_reply->times.authtime + time_rec
		+	* enc_tkt_reply->times.renew_till = enc_tkt_reply->times.endtime;

@@ Line 91: / Line 91: @@
 # Implement gss_pseudo_random.
 # Are not able to trigger an additional AS_REQ exchange (as it may lead the pre-authentication process to get into an infinite loop).
-# Provide the following GSS services (in order to provide a secure authenticatio):
+# Provide the following GSS services (in order to provide a secure authentication):
 ## GSS_C_MUTUAL_FLAG
 ## GSS_C_REPLAY_FLAG

@@ Line 78: / Line 78: @@
 # Some GSS-API mechanism allow a federated authentication (e.g. GSS-EAP). This means that the cname introduced by the client is not present into the KDC database. In this situations, draft-perez-abfab-eap-gss-preauth-01 defines the use of WELLKNOWN:FEDERATED as the cname value. This way, the KDC knows that the client name will be provided by the GSS-preauth plugin at the end of the authentication. To implement this:
 ## In the KDC side we propose to just insert the principal WELLKNOW:FEDERATED with a random password (as the actual reply key will be derived from the gss_pseudo_random function), in a similar way as done with the WELLKNOWN:ANONYMOUS.
-## In the client side, a new pre-auth option (e.g. -X federated) is used to indicate that client is in a federated environment, and that the provided cname MUST be replaced with WELLKNOWN:FEDERATED, while the actual cname is still used to acquire the credentials.
+## In the client side, a new pre-auth option (e.g. -X gss_federated) is used to indicate that client is in a federated environment, and that the provided cname MUST be replaced with WELLKNOWN:FEDERATED, while the actual cname is still used to acquire the credentials.
-# If the client wanted to use the default credentials for the GSS mechanism, he could use another pre-auth option (e.g. -X gss_default_cred) to indicated that NULL MUST be used as client name to acquire the initial credentials. Note that in this case, the provided cname will be still being used as the cname in the AS_REQ message.
+# If the client wanted to use the default credentials for the GSS mechanism, he could use another pre-auth option (e.g. -X gss_default) to indicated that NULL MUST be used as client name to acquire the initial credentials. Note that in this case, the provided cname will be still being used as the cname in the AS_REQ message.
 For instance, to execute a GSS-EAP authentication with default credentials (for example, to lauch the moonshot's identity selector), both options should be indicated.
 == Allowed GSS-API mechanisms ==
@@ Line 89: / Line 91: @@
 # Implement gss_pseudo_random.
 # Are not able to trigger an additional AS_REQ exchange (as it may lead the pre-authentication process to get into an infinite loop).

@@ Line 32: / Line 32: @@
  error_code KRB5KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTION, "An unsupported critical FAST option was requested"
  error_code KRB5PLACEHOLD_94,	"KRB5 error code 94"
 </nowiki>