RFC 1411 (rfc1411) - Page 3 of 4

Telnet Authentication: Kerberos Version 4

RFC 1411             Kerberos Version 4 for Telnet          January 1993


   account, then the client would send IAC SB AUTHENTICATION NAME "pete"
   IAC SE IAC SB AUTHENTICATION IS KERBEROS_V4 AUTH  IAC SE The server would then authenticate the user as "joe"
   from the ticket information, and since "pete" is allowing "joe" to
   use his account, the server would send back ACCEPT.  If mutual
   authentication is being used, the the client would send a CHALLENGE,
   and verify the RESPONSE that the server sends back.

       Client                           Server
                                        IAC DO AUTHENTICATION
       IAC WILL AUTHENTICATION
       [ The server is now free to request authentication information.
         ]
                                        IAC SB AUTHENTICATION SEND
                                        KERBEROS_V4 CLIENT|MUTUAL
                                        KERBEROS_V4 CLIENT|ONE_WAY IAC
                                        SE
       [ The server has requested mutual Version 4 Kerberos
         authentication.  If mutual authentication is not supported,
         then the server is willing to do one-way authentication.

         The client will now respond with the name of the user that it
         wants to log in as, and the Kerberos ticket.  ]
       IAC SB AUTHENTICATION NAME
       "pete" IAC SE
       IAC SB AUTHENTICATION IS
       KERBEROS_V4 CLIENT|MUTUAL AUTH
       
       IAC SE
       [ The server responds with an ACCEPT command to state that the
         authentication was successful.  ]
                                        IAC SB AUTHENTICATION REPLY
                                        KERBEROS_V4 CLIENT|MUTUAL ACCEPT
                                        IAC SE
       [ Next, the client sends across a CHALLENGE to verify that it is
         really talking to the right server.  ]
       IAC SB AUTHENTICATION IS
       KERBEROS_V4 CLIENT|MUTUAL
       CHALLENGE xx xx xx xx xx xx xx
       xx IAC SE
       [ Lastly, the server sends across a RESPONSE to prove that it
         really is the right server.
                                        IAC SB AUTHENTICATION REPLY
                                        KERBEROS_V4 CLIENT|MUTUAL
                                        RESPONSE yy yy yy yy yy yy yy yy
                                        IAC SE





Telnet Working Group