Projects/Authentication indicator

This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.

This project will implement a way to restrict access to services based on how the initial authentication was performed.

Background

Kerberos deployments may support pre-authentication mechanisms, such as PKINIT or OTP, which may confer a higher level of confidence in the authentication than the use of a password alone. A deployment may wish to require that some resources can only be accessed using tickets which were obtained using high-confidence pre-authentication.

Currently, the most practical way to enforce this requirement is to make sure that certain principals can only authenticate using high-confidence pre-authentication, and then grant resource access only to those principals. Such principals may be separated from the principals used for day-to-day activities of the end-user by giving them different names (e.g. ghudson/root@ATHENA.MIT.EDU as opposed to ghudson@ATHENA.MIT.EDU), at the cost of complicating realm administration and auditing.

This project will implement a means of restricting access without requiring that a principal always authenticates using high-strength pre-authentication, by marking how the ticket was initially obtained. The Kerberos protocol defines several existing methods for doing this, none of which are sufficiently general:

• The pre-authent ticket flag indicates that some form of prea-authentication was used, but does not indicate what it was.

• The hw-authent ticket flag was intended to indicate that a hardware device was used during pre-authentication. It is rarely used, as the KDC usually cannot tell whether a client used a software or hardware device to produce a certificate or OTP token value. While it could be re-purposed to mean "high-confidence pre-authentication" in general, it would still be poorly defined and not very granular.

• PKINIT (RFC 4556) defines the AD_INITIAL_VERIFIED_CAS authdata type, which shows the certification path of the client certificate. This type is specific to PKINIT, and would be cumbersome for an application server to use as it would have to be configured with specific knowledge about PKINIT certification authorities. There is no equivalent for FAST OTP.

• RFC 6113 defines AD-authentication-strength, which contains the numeric codes of the pre-authentication types used to authenticate the client, and possibly additional information for each type (but no additional information is currently defined). Again, to use this element, an application server would have to be configured with specific knowledge about pre-authentication mechanisms and the confidence they confer.

Scope

This project will implement the AUTHENTICATION-INDICATOR element defined in draft-jain-kitten-krb-auth-indicator. The KDC makes a determination about pre-authentication confidence at the time of initial authentication, and communicates this to services via one or more site-defined string values. The AUTHENTICATION-INDICATOR element is carried within a CAMMAC (draft-ietf-krb-wg-cammac), which allows it to be carried from the evidence ticket of an S4U2PROXY request into the delegated ticket.

Access restriction based on AUTHENTICATION-INDICATOR may take place either within KDC through its ticket policy or on the application server itself. The latter allows more fine-grained access control, but also requires changes to application server code. This project will cover only enforcement on the KDC; enforcement on application servers will be a follow-on project.

This project must be useful with the built-in KDB modules. A third-party KDB module may provide additional input into the process, but basic functionality must be present in the core system.

Design

This project requires five elements:

• Encoding and decoding CAMMACs and AUTHENTICATION-INDICATORs
• Deciding on indicators for a preauthentication
• Generating authdata for an initial ticket
• Re-signing the CAMMAC across TGS and S4U2PROXY requests
• Enforcing indicator restrictions within the KDC

ASN.1 encoders and decoders

We will require ASN.1 encoders and decoders for the CAMMAC and AUTHENTICATION-INDICATOR elements. Commit a7dc565cafbaa6c18d5a76ea3cc823c7159a0d6b can be used as a reference for what files need to be modified to add new types.

We will likely want a public libkrb5 API for manipulating CAMMACs, like we have for PACs.

Deciding on authentication indicators

The KDC will need some way of deciding on zero or more authentication indicator strings based on a successful pre-authentication. It must take into account the particulars of the pre-authentication mechanism as well as site preferences.

Here is the simplest design: each kdcpreauth module can generate authentication indicators via a new callback. kdcpreauth modules such as PKINIT and OTP will have code to yield indicators based on configuration. For instance, OTP will have a token type configuration element to generate an authentication indicator when that token type is successfully used. The KDB module does not have any input into authentication indicator generation.

A more complicated and flexible approach would have each module producing detailed parameters (PKINIT certificate and signing chain, OTP request and token type, etc.). These parameters could be provided to the KDB module and/or to a new pluggable interface module in order to generate indicators. Modules will require knowledge of each mechanism's specific parameters to make a decision.

Generating indicator authdata for initial tickets

Time permitting, kdc_authdata.c will be refactored for simplicity and improved maintainability.

In kdc_authdata.c, a new static authdata system (or the equivalent after refactoring) will generates an AUTHENTICATION-INDICATOR and signed CAMMAC if any authentication indicators are generated by the preauthentication process.

Preserving CAMMAC across TGS and S4U2PROXY requests

In kdc_authdata.c, handle_tgt_authdata (or the equivalent after refactoring) will detect a CAMMAC in the TGT or evidence ticket, validate it, and re-sign it for the result ticket. If the CAMMAC was signed by a different server, the CAMMAC contents will be filtered to include only AUTHENTICATION-INDICATOR elements, as we do not know in general whether it is safe in general to vouch for another KDC's authorization assertions.

Enforcing indicator restrictions on the KDC

We can add a new principal attribute, perhaps using string attributes, which deny access to the principal as a server unless a specified authentication indicator is present.

More generally, we can create a new pluggable interface for KDC policy. A KDC policy module would be able to access the authentication indicator within the CAMMAC in the TGT, and deny access to certain services based on the lack of particular indicators.

The KDB module's check_policy_tgs method can also contribute to this decision.