API Build-data JSON Resources
Theme

Choose how MSRBot.io looks on this device.

Auto (match system) Light mode Dark mode

Preference is stored in this browser only.

IETF RFC 6113
[ACTIVE]

A Generalized Framework for Kerberos Pre-Authentication

Metadata

Publisher
IETF
Doc Type
Standard
Pages
48
Abstract
Kerberos is a protocol for verifying the identity of principals (e.g., a workstation user or a network server) on an open network. The Kerberos protocol provides a facility called pre-authentication. Pre-authentication mechanisms can use this facility to extend the Kerberos protocol and prove the identity of a principal. This document describes a more formal model for this facility. The model describes what state in the Kerberos request a pre-authentication mechanism is likely to change. It also describes how multiple pre-authentication mechanisms used in the same request will interact. This document also provides common tools needed by multiple pre-authentication mechanisms. One of these tools is a secure channel between the client and the key distribution center with a reply key strengthening mechanism; this secure channel can be used to protect the authentication exchange and thus eliminate offline dictionary attacks. With these tools, it is relatively straightforward to chain multiple authentication mechanisms, utilize a different key management system, or support a new key agreement algorithm. [STANDARDS-TRACK]
Publication Date
2011-04-01
Status Note
Proposed Standard
DOI
10.17487/RFC6113
Link
https://doi.org/10.17487/RFC6113
Author(s)
Sam Hartman
Larry Zhu
Latest version of IETF RFC 6113

Document Versions — IETF RFC 6113

  • ▶ IETF RFC 6113 (2011-04-01)
    THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

Bibliographic Reference(s)

  • Bellovin, S. and M. Merritt, "Augmented Encrypted Key Exchange: A Password-Based Protocol Secure Against Dictionary Attacks and Password File Compromise, Proceedings of the 1st ACM Conference on Computer and Communications Security, ACM Press.", November 1993. EXTERNAL
  • Astrand, L. and L. Zhu, "PK-INIT algorithm agility" , Work in Progress, August 2008. EXTERNAL
  • IEEE, "IEEE P1363.2: Password-Based Public-Key Cryptography", 2004. EXTERNAL
  • Hartman, S., Ed., Raeburn, K., and L. Zhu, "Kerberos Principal Name Canonicalization and KDC-Generated Cross-Realm Referrals", Work in Progress, March 2011. EXTERNAL
  • Zhu, L., Altman, J., and N. Williams, "Public Key Cryptography Based User-to-User Authentication - (PKU2U)", Work in Progress, November 2008. EXTERNAL
  • Sakane, S., Zrelli, S., and M. Ishiyama , "Problem statement on the cross-realm operation of Kerberos in a specific system", Work in Progress, July 2007. EXTERNAL
  • Tung, B., Neuman, C., Hur, M., Medvinsky, A., Medvinsky, S., Wray, J., and J. Trostle, "Public Key Cryptography for Initial Authentication in Kerberos", Work in Progress, July 1999. EXTERNAL
  • Microsoft, "Kerberos Protocol Extensions", < http:// msdn.microsoft.com/en-us/library/cc206927.aspx >. EXTERNAL
  • Richards, G., "OTP Pre-authentication" , Work in Progress, February 2011. EXTERNAL
  • Crawford, M., "Passwordless Initial Authentication to Kerberos by Hardware Preauthentication", Work in Progress, October 2006. EXTERNAL
  • Hornstein, K., Renard, K., Neuman, C., and G. Zorn, "Integrating Single-use Authentication Mechanisms with Kerberos", Work in Progress, July 2004. EXTERNAL
  • RFC4557 — RFC4557 EXTERNAL
  • IETF RFC 4757 [Active*]
Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6113.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree
Reference this Doc

Plain text (ISO 690 compliant)

Preview:
IETF RFC 6113, A Generalized Framework for Kerberos Pre-Authentication. Available at https://doi.org/10.17487/RFC6113
Snippet:
IETF RFC 6113, A Generalized Framework for Kerberos Pre-Authentication. Available at https://doi.org/10.17487/RFC6113

HTML (ISO 690 compliant)

Preview:
IETF RFC 6113, A Generalized Framework for Kerberos Pre-Authentication. Available at https://doi.org/10.17487/RFC6113
Snippet:
<span class="citation"><cite>IETF RFC 6113</cite>, A Generalized Framework for Kerberos Pre-Authentication. Available at <a href="https://doi.org/10.17487/RFC6113" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6113</a></span>

SMPTE Icon SMPTE's HTML Pub

Preview:
IETF RFC 6113, A Generalized Framework for Kerberos Pre-Authentication
doi: 10.17487/RFC6113
url: https://doi.org/10.17487/RFC6113
Snippet:
<li>
<cite id="bib-rfc6113">IETF RFC 6113</cite>, A Generalized Framework for Kerberos Pre-Authentication
<span class="doi">10.17487/RFC6113</span>
</li>

Referenced By