RFC 1510 (rfc1510) - Page 2 of 112

The Kerberos Network Authentication Service (V5)

RFC 1510                        Kerberos                  September 1993


Background

   The Kerberos model is based in part on Needham and Schroeder's
   trusted third-party authentication protocol [3] and on modifications
   suggested by Denning and Sacco [4].  The original design and
   implementation of Kerberos Versions 1 through 4 was the work of two
   former Project Athena staff members, Steve Miller of Digital
   Equipment Corporation and Clifford Neuman (now at the Information
   Sciences Institute of the University of Southern California), along
   with Jerome Saltzer, Technical Director of Project Athena, and
   Jeffrey Schiller, MIT Campus Network Manager.  Many other members of
   Project Athena have also contributed to the work on Kerberos.
   Version 4 is publicly available, and has seen wide use across the
   Internet.

   Version 5 (described in this document) has evolved from Version 4
   based on new requirements and desires for features not available in
   Version 4.  Details on the differences between Kerberos Versions 4
   and 5 can be found in [5].

Table of Contents

   1. Introduction .......................................    5
   1.1. Cross-Realm Operation ............................    7
   1.2. Environmental assumptions ........................    8
   1.3. Glossary of terms ................................    9
   2. Ticket flag uses and requests ......................   12
   2.1. Initial and pre-authenticated tickets ............   12
   2.2. Invalid tickets ..................................   12
   2.3. Renewable tickets ................................   12
   2.4. Postdated tickets ................................   13
   2.5. Proxiable and proxy tickets ......................   14
   2.6. Forwardable tickets ..............................   15
   2.7. Other KDC options ................................   15
   3. Message Exchanges ..................................   16
   3.1. The Authentication Service Exchange ..............   16
   3.1.1. Generation of KRB_AS_REQ message ...............   17
   3.1.2. Receipt of KRB_AS_REQ message ..................   17
   3.1.3. Generation of KRB_AS_REP message ...............   17
   3.1.4. Generation of KRB_ERROR message ................   19
   3.1.5. Receipt of KRB_AS_REP message ..................   19
   3.1.6. Receipt of KRB_ERROR message ...................   20
   3.2. The Client/Server Authentication Exchange ........   20
   3.2.1. The KRB_AP_REQ message .........................   20
   3.2.2. Generation of a KRB_AP_REQ message .............   20
   3.2.3. Receipt of KRB_AP_REQ message ..................   21
   3.2.4. Generation of a KRB_AP_REP message .............   23
   3.2.5. Receipt of KRB_AP_REP message ..................   23



Kohl & Neuman