Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 21
Abstract: This document updates the Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) standard (RFC 4556) to remove protocol structures tied to specific cryptographic algorithms. The PKINIT key derivation function is made negotiable, and the digest algorithms for signing the pre-authentication data and the client's X.509 certificates are made discoverable. These changes provide preemptive protection against vulnerabilities discovered in the future in any specific cryptographic algorithm and allow incremental deployment of newer algorithms.
Publication Date: 2019-07-01
Status Note: Proposed Standard
DOI: 10.17487/RFC8636
Link: https://doi.org/10.17487/RFC8636
Author(s): Love Astrand
Larry Zhu
Margaret Cullen
Greg Hudson

Latest version of IETF RFC 8636

Document Versions — IETF RFC 8636

▶ IETF RFC 8636 (2019-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

NIST.SP.800-56A — NIST EXTERNAL
NIST.SP.800-56C — SP80056C EXTERNAL
IETF RFC 2119 [Active*]
IETF RFC 3961 [Active*]
IETF RFC 4120 [Active*]
IETF RFC 4556 [Active*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 5652 [Active*]
IETF RFC 6234 [Active*]
IETF RFC 8174 [Active*]
T-REC-X.680.2015 — X.680 EXTERNAL
T-REC-X.690.2015 — X.690 EXTERNAL

Bibliographic Reference(s)

10.1007-11426639_1 — WANG04 EXTERNAL
IETF RFC 1321 [Active*]
IETF RFC 6150 [Active*]
IETF RFC 6194 [Active*]
IETF RFC 7696 [Active*]
IETF RFC 8062 [Active*]
RFC8070 — RFC8070 EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8636.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 8636, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility. Available at https://doi.org/10.17487/RFC8636

Snippet:

IETF RFC 8636, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility. Available at https://doi.org/10.17487/RFC8636

HTML (ISO 690 compliant)

Preview:

IETF RFC 8636, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility. Available at https://doi.org/10.17487/RFC8636

Snippet:

<span class="citation"><cite>IETF RFC 8636</cite>, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility. Available at <a href="https://doi.org/10.17487/RFC8636" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8636</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 8636, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility
doi: 10.17487/RFC8636
url: https://doi.org/10.17487/RFC8636

Snippet:

<li>
<cite id="bib-rfc8636">IETF RFC 8636</cite>, Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) Algorithm Agility
<span class="doi">10.17487/RFC8636</span>
</li>