RFC 3244 (rfc3244) - Page 2 of 7

Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols

Alternative Format: Original Text Document
< Previous
Next >
RFC 3244      Microsoft Windows 2000 Kerberos Change & Set February 2002


2.  The Protocol

   The service accepts requests on UDP port 464 and TCP port 464 as
   well.  The protocol consists of a single request message followed by
   a single reply message.  For UDP transport, each message must be
   fully contained in a single UDP packet.

   For TCP transport, there is a 4 octet header in network byte order
   that precedes the message and specifies the length of the message.

   Request Message

     0                   1                   2                   3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |         message length        |    protocol version number    |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |          AP_REQ length        |         AP_REQ data           /
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    /                        KRB-PRIV message                       /
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   All 16 bit fields are in big-endian order.

   message length field: contains the number of bytes in the message
   including this field.

   protocol version number: contains the hex constant 0xff80 (big-endian
   integer).

   AP-REQ length: length of AP-REQ data, in bytes.  If the length is
   zero, then the last field contains a KRB-ERROR message instead of a
   KRB-PRIV message.

   AP-REQ data: (see [1]) The AP-REQ message must be for the service
   principal kadmin/changepw@REALM, where REALM is the REALM of the user
   who wishes to change/set his password.  The authenticator in the AP-
   REQ must include a subsession key.  (NOTE: The subsession key must be
   pseudo-randomly generated and must never be reused for multiple
   authenticators.)  To enable setting of passwords, it is not required
   that the initial flag be set in the Kerberos service ticket.

   KRB-PRIV message (see [1]) This user-data field in the KRB-PRIV
   message is encrypted using the subkey from the authenticator in the
   AP-REQ data.  The usec and seq-number fields of the KRB_PRIV message
   are present and have the same value as the seq-number field in the





Swift, et al.                Informational
< Previous
Next >