A Pseudo-Random Function (PRF) API Extension for the Generic Security Service Application Program Interface (GSS-API)
Extracted elements (20)
The document defers the question of how portable applications detect support for and access this GSS-API extension, expecting a future comprehensive update to the GSS-API to address this; it specifies only the abstract API and C bindings.
The PRF extension is introduced because applications using GSS-API for authentication but not for transport security have no way to obtain keying material from established security contexts, making GSS-API ineffective for such use cases. The extension fills this gap by providing a standard keying interface.
The prf_key parameter distinguishes between keys available only after full context establishment (GSS_C_PRF_KEY_FULL) and keys available during partial establishment (GSS_C_PRF_KEY_PARTIAL), accommodating mechanisms like Kerberos V where one peer may assert a key considered better than others.
For some mechanisms or contexts, GSS_C_PRF_KEY_FULL and GSS_C_PRF_KEY_PARTIAL MAY refer to the same cryptographic keys; for mechanisms like Kerberos V GSS-API (RFC 1964), where one peer may assert a better key, they MAY be different keys.
It MUST NOT be possible to access any raw keys of a security context through GSS_Pseudo_random(), no matter what inputs are given.
Mechanisms MUST be able to consume all prf_in input data that is 2^14 or fewer octets. If a mechanism cannot consume as much input data as provided, GSS_Pseudo_random() MUST return GSS_S_FAILURE.
Mechanisms MUST be able to output at least up to 2^14 octets. If the implementation cannot produce the desired output due to lack of resources, it MUST return GSS_S_FAILURE and MUST set a suitable minor status code.
The output of GSS_Pseudo_random() MUST be a pseudo-random function of the input keyed with key material from the given security context; the chances of getting the same output given different input parameters should be exponentially small.
The outputs of GSS_Pseudo_random() and the mechanism's per-message tokens for the given security context MUST be 'cryptographically separate'; it must not be feasible to recover key material for one operation or transform tokens and PRF outputs from one to the other.
Upon full establishment of a security context, all cryptographic keys and negotiations used for computing the PRF with any prf_key MUST be authenticated (mutually, if mutual authentication is in effect).
When successfully applied to the same inputs by an initiator and acceptor using the same security context, GSS_Pseudo_random() MUST produce the same results for both, even if called multiple times (as long as the context is not expired).
GSS_Pseudo_random() is the core API function that applies a mechanism's keyed PRF to input data ('prf_in'), keyed with material from the given security context identified by 'prf_key', producing an octet string ('prf_out') of desired_output_len length.
Return major status codes for GSS_Pseudo_random() include: GSS_S_COMPLETE (success), GSS_S_NO_CONTEXT (null context), GSS_S_CONTEXT_EXPIRED (expired context), GSS_S_UNAVAILABLE (mechanism lacks support or key unavailable), and GSS_S_FAILURE (general failure including zero-length input or desired_output_len of zero).
The prf_key parameter takes values GSS_C_PRF_KEY_FULL (0), GSS_C_PRF_KEY_PARTIAL (1), or mechanism-specific values. GSS_C_PRF_KEY_FULL corresponds to the best key for fully-established contexts; GSS_C_PRF_KEY_PARTIAL corresponds to a key available during partial establishment.
Applications MUST assume that authentication has not completed until the security context is fully established, even if a mechanism supports the GSS PRF with partially established contexts.
Callers should avoid accidentally calling GSS_Pseudo_random() with the same inputs; a recommended technique is to prepend a purpose-indicating string to prf_in so that unique calling contexts yield unique inputs.
GSS mechanisms' PRF functions should use a key derived from the contexts' authenticated session keys and should preserve the forward security properties of the mechanisms' key exchanges.
Large prf_in data or large desired_output_length values may cause significant computational cost, creating a potential denial-of-service attack vector; applications SHOULD place appropriate limits on input octet strings received from peers without integrity protection.
PRFs can produce only limited amounts of cryptographically secure output; implementers are advised to limit PRF output to the necessary minimum unless qualified to evaluate the cryptographic properties of the specific PRF in use.
The C-binding defines gss_pseudo_random() with parameters: minor_status (OM_uint32*), context (gss_ctx_id_t), prf_key (int), prf_in (const gss_buffer_t), desired_output_len (ssize_t), and prf_out (gss_buffer_t). Constants GSS_C_PRF_KEY_FULL=0 and GSS_C_PRF_KEY_PARTIAL=1 are defined.