Kerberos Options for DHCPv6
Extracted elements (20)
Industrial and similar systems often do not use DNS (they have their own namespaces and name resolution, including preconfigured device tables, and do not use FQDNs), but most do use DHCP. Adding a DNS server to such environments decreases reliability and increases management cost, motivating a DHCP-based mechanism for KDC discovery.
This option does not replace or modify existing methods (e.g., DNS SRV) for obtaining Kerberos configuration information; it is an additional mechanism for environments where DNS is unavailable or undesirable.
When a client implements both the DNS-based KDC discovery method (RFC 4120 Section 7.2.3.2) and the DHCPv6 method defined here, the choice of method is determined by local policy as configured by the realm administrator. When no policy is set and both are available, DNS is preferred.
All Kerberos options except the Kerberos KDC Option MUST NOT appear more than once in a DHCPv6 message.
Manual configuration of Kerberos information on the client SHOULD be preferred over configuration via the DHCPv6 server.
The encoding of realm-name fields in the Realm Name, Default Realm Name, and KDC Options MUST conform to the definition of 'Realm' in Section 5.2.2 of RFC 4120.
The encoding of the principal-name field in the Kerberos Principal Name Option MUST conform to the definition of 'PrincipalName' in Section 5.2.2 of RFC 4120.
To minimize potential vulnerabilities from modified DHCPv6 responses, a client SHOULD use DHCPv6 authentication as defined in Section 21 of RFC 3315.
When a server replies with more than one KDC option, the client's use of the Priority and Weight fields MUST follow the specification for DNS SRV [RFC 2782].
When both DNS and DHCPv6 methods are available and no criteria have been specified, Kerberos information from DNS SHOULD be preferred over DHCPv6.
Kerberos Default Realm Name Option (OPTION_KRB_DEFAULT_REALM_NAME = 77) is sent by a DHCPv6 server to specify the default Kerberos realm to both clients and application servers. Its format is identical to the Realm Name Option.
RFC 6784 defines four new DHCPv6 options for Kerberos configuration: Kerberos Principal Name Option (75), Kerberos Realm Name Option (76), Kerberos Default Realm Name Option (77), and Kerberos KDC Option (78). These allow DHCPv6 to distribute Kerberos realm names and KDC addresses without requiring DNS.
Transport Type field in the KDC Option is 8 bits and indicates the transport protocol for Kerberos: 0 = Reserved, 1 = UDP, 2 = TCP, 3 = TLS, 4–254 = Unassigned, 255 = Reserved.
IANA assigned four option codes from the DHCPv6 Option Codes registry: 75 (OPTION_KRB_PRINCIPAL_NAME), 76 (OPTION_KRB_REALM_NAME), 77 (OPTION_KRB_DEFAULT_REALM_NAME), and 78 (OPTION_KRB_KDC).
IANA created the Kerberos Message Transport Types sub-registry under the Kerberos Parameters registry with initial values: 0 = Reserved, 1 = UDP, 2 = TCP, 3 = TLS, 4–254 = Unassigned, 255 = Reserved. Future assignments require IETF Review per BCP 26.
A shared, unconfigured workstation that lacks a host key cannot validate the Ticket-Granting Ticket issued by the KDC. A modified DHCPv6 response pointing to a malicious KDC would go undetected by such a workstation, potentially allowing unauthorized access.
DHCPv6 messages can be modified in transit; an adversary may redirect a client to a malicious KDC (a DoS attack). However, a malicious KDC cannot complete the exchange because it does not know the shared key, and the client can detect the mismatch using the shared key.
Kerberos KDC Option (OPTION_KRB_KDC = 78): 16-bit option-code, 16-bit option-len (23 + realm-name length), 16-bit Priority, 16-bit Weight, 8-bit Transport Type, 16-bit Port Number, 128-bit KDC IPv6 address, and variable-length realm-name.
Kerberos Principal Name Option (OPTION_KRB_PRINCIPAL_NAME = 75): 16-bit option-code, 16-bit option-len, followed by a variable-length principal-name field encoded as PrincipalName per RFC 4120 Section 5.2.2.
Kerberos Realm Name Option (OPTION_KRB_REALM_NAME = 76): 16-bit option-code, 16-bit option-len (length of realm-name in octets), and variable-length realm-name encoded as Realm per RFC 4120 Section 5.2.2.