A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism
obsoletes
- rfc-4402 — A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism
Extracted elements (13)
This document obsoletes RFC 4402 and changes the PRF+ counter to start at 0 instead of 1. RFC 4402 specified starting at 1, but multiple implementations already used 0, making the original specification non-interoperable with deployed code.
RFC 4402 is reclassified as Historic because its counter-starts-at-1 specification conflicts with existing implementations that start the counter at 0. Implementations conforming to RFC 4402 would not interoperate with those conforming to this document.
For GSS_C_PRF_KEY_PARTIAL, the PRF+ MUST use the sub-session key asserted by the initiator if any exists, or the Ticket's session key otherwise.
The PRF+ MUST be keyed with the key indicated by the 'prf_key' input parameter. For GSS_C_PRF_KEY_FULL, use the acceptor's sub-session key if present, else the initiator's sub-session key if present, else the Ticket's session key.
When the input size exceeds 2^14 octets per RFC 4401 and exceeds an implementation's resources, the mechanism MUST return GSS_S_FAILURE with GSS_KRB5_S_KG_INPUT_TOO_LONG as the minor status code.
The Kerberos V GSS-API PRF is defined as PRF+(K, L, S) = truncate(L, T0 || T1 || .. || Tn), where Tn = pseudo-random(K, n || S). K is the session key, L is the desired output length, S is the input string, and pseudo-random() is the Kerberos V PRF from RFC 3961.
The maximum output size of the Kerberos V mechanism's GSS-API PRF is 2^32 times the output size of the pseudo-random() function for the encryption type of the given key, owing to the 32-bit counter.
This document has no current IANA actions. If a relevant IANA registry of GSS-API symbols and constants is created in the future, the GSS_KRB5_S_KG_INPUT_TOO_LONG minor status code should be added to it.
Kerberos V encryption types' PRF functions use a key derived from session keys and should preserve the forward security properties of the mechanism's key exchanges.
Legacy Kerberos V encryption types, particularly single-DES encryption types, may be weak and their use in this PRF construction inherits those weaknesses.
The computational cost of the PRF+ grows with input and output octet string lengths, but the counter-based construction allows parallelization of the underlying pseudo-random() calls.
Use of Ticket session keys instead of sub-session keys is dangerous because ticket reuse leads to key reuse. Initiators should always assert sub-session keys, and acceptors should assert sub-session keys at least when initiators fail to do so.
The counter 'n' in the PRF+ construction is encoded as a network byte order 32-bit unsigned binary number, prepended to the input string S before each invocation of the underlying Kerberos V pseudo-random function.