90 likes | 287 Views
GSSAPI-CFX. Larry Zhu Microsoft Corporation IETF 58. Goals. Support cryptosystem framework Support AES enctypes in GSSAPI Backward compatible with existing apps Interoperability. Status of the draft. Latest revision draft-ietf-krb-wg-gssapi-cfx-03.txt Submitted on 10/26/2003
E N D
GSSAPI-CFX Larry Zhu Microsoft Corporation IETF 58
Goals • Support cryptosystem framework • Support AES enctypes in GSSAPI • Backward compatible with existing apps • Interoperability
Status of the draft • Latest revision • draft-ietf-krb-wg-gssapi-cfx-03.txt • Submitted on 10/26/2003 • Design team Ken Raeburn, Nicolas Williams, Sam Hartman, Karthik Jaganathan, Larry Zhu, Paul Leach et al
Open issues in draft -03 • Generic token framing in per-message tokens (call for consensus) • MUST vs SHOULD: acceptor-asserted-subkey (resolved) • List of “not-newer” enctypes: name and values (resolved)
Kcrypto Enctypes des-cbc-crc 1 6.2.3 des-cbc-md4 2 6.2.2 des-cbc-md5 3 6.2.1 [reserved] 4 des3-cbc-md5 5 [reserved] 6 des3-cbc-sha1 7 dsaWithSHA1-CmsOID 9 (pkinit) md5WithRSAEncryption-CmsOID 10 (pkinit) sha1WithRSAEncryption-CmsOID 11 (pkinit) rc2CBC-EnvOID 12 (pkinit) rsaEncryption-EnvOID 13 (pkinit from PKCS#1 v1.5) rsaES-OAEP-ENV-OID 14 (pkinit from PKCS#1 v2.0) des-ede3-cbc-Env-OID 15 (pkinit) des3-cbc-sha1-kd 16 6.3 * aes128-cts-hmac-sha1-96 17 [KRB5-AES] * aes256-cts-hmac-sha1-96 18 [KRB5-AES] rc4-hmac 23 (Microsoft)
What is new (from 1964) • Directional keys • 64bit sequence numbers • Generic token framing • New token IDs 0404 for MIC tokens, 0504 for Wrap tokens • Direction indicator as a single flag bit • “Extra Count” • Right Rotation Count • Empty context deletion tokens
What is new (cont’d) • Acceptor asserted subkey • Token ID assignment considerations • Handling of unknown token IDs
Inherited from 1964 Everything else, with minor improvements: • Delegation KRB_CRED MUST be encrypted in session key • Channel binding encoding clarified