Key Distribution Center (KDC) Server Address Sub-option for the Dynamic Host Configuration Protocol (DHCP) CableLabs Client Configuration (CCC) Option
Extracted elements (11)
CableLabs client devices described in CableHome 1.0/1.1 cannot perform DNS lookup of the Kerberos Realm name to find KDC addresses (unlike devices in RFC 3495), necessitating an explicit DHCP sub-option to deliver the KDC server address directly.
The KDC Server Address sub-option is specifically designed as a sub-option of the CCC DHCP option (RFC 3495) and is intended for CableLabs CableHome-compliant residential gateways using Kerberos for SNMPv3 authentication between the Portal Service element and the cable operator's SNMP entity.
If multiple KDC servers are listed in the sub-option, they MUST be listed in decreasing order of priority.
The length of the KDC Server Address sub-option MUST always be a multiple of 4, reflecting that each KDC server address is a 4-octet IPv4 address.
The KDC Server Address sub-option (sub-option code 10) is a sub-option of the CableLabs Client Configuration (CCC) DHCP option, used to convey the network addresses of one or more Kerberos Key Distribution Center servers to CableLabs client devices.
IANA has assigned and registered sub-option code 10 of the CableLabs Client Configuration (CCC) DHCP option to the KDC Server Address sub-option defined in this document.
Kerberos requires mutual client-server authentication, so if an attacker replaces the KDC Server Address sub-option with a rogue IP, the client device's authentication attempt against the rogue KDC will fail because the rogue server cannot present valid Kerberos credentials.
Service providers can mitigate exposure by placing KDC servers on a separate subnetwork and deploying a firewall that only allows connections needed for current provisioning processes, optionally using DHCP-server-to-KDC password authentication.
The CCC option can be used to misdirect network traffic by providing incorrect DHCP server addresses, provisioning server addresses, or Kerberos realm names, enabling DoS attacks, man-in-the-middle attacks, or customer redirection by a malicious service provider.
This document relies on the DHCP protocol for authentication and security and does not provide security beyond what DHCP itself provides. Potential DHCP attack exposures are discussed in RFC 2131 Section 7 and RFC 3118.
The KDC Server Address sub-option encodes IPv4 addresses in a TLV format: a 1-octet sub-option code (10), a 1-octet length field (n), followed by n octets of IPv4 addresses (4 octets each). Minimum length is 4 octets; length must always be a multiple of 4.