One document matched: draft-ietf-cat-lipkey-01.txt
Differences from draft-ietf-cat-lipkey-00.txt
Network Working Group M. Eisler
Internet Draft Sun Microsystems, Inc.
Document: draft-ietf-cat-lipkey-01.txt June 1999
LIPKEY - A Low Infrastructure Public Key Mechanism Using SPKM
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Abstract
This memorandum describes a method whereby one can use GSS-API
[RFC2078] to supply a secure channel between a client and server,
authenticating the client with a password, and server with a public
key certificate. As such, it is analogous to the common low
infrastructure usage of the Transport Layer Service (TLS) protocol
[RFC2246].
The method leverages the existing Simple Public Key Mechanism (SPKM)
[RFC2025], and is specified as a separate GSS-API mechanism (LIPKEY)
layered on top of SPKM.
Expires: December 1999 [Page 1]
INTERNET-DRAFT LIPKEY June 1999
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. LIPKEY's Requirements of SPKM . . . . . . . . . . . . . . . . 4
2.1. Mechanism Type . . . . . . . . . . . . . . . . . . . . . . . 4
2.2. Name Type . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3. Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.4. Context Establish Tokens . . . . . . . . . . . . . . . . . . 6
2.4.1. REQ-TOKEN Content Requirements . . . . . . . . . . . . . . 6
2.4.1.1. algId and req-integrity . . . . . . . . . . . . . . . . 7
2.4.1.2. Req-contents . . . . . . . . . . . . . . . . . . . . . . 7
2.4.1.2.1. Options . . . . . . . . . . . . . . . . . . . . . . . 7
2.4.1.2.2. Conf-Algs . . . . . . . . . . . . . . . . . . . . . . 7
2.4.1.2.3. Intg-Algs . . . . . . . . . . . . . . . . . . . . . . 7
2.4.2. REP-TI-TOKEN Content Requirements . . . . . . . . . . . . 7
2.4.2.1. algId . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.4.2.2. rep-ti-integ . . . . . . . . . . . . . . . . . . . . . . 8
3. How LIPKEY Uses SPKM . . . . . . . . . . . . . . . . . . . . . 8
3.1. Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2. Initiator . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2.1. GSS_Import_name . . . . . . . . . . . . . . . . . . . . . 8
3.2.2. GSS_Acquire_cred . . . . . . . . . . . . . . . . . . . . . 8
3.2.3. GSS_Init_sec_context . . . . . . . . . . . . . . . . . . . 8
3.2.3.1. LIPKEY Caller Specified anon_req_flag as TRUE . . . . . 9
3.2.3.2. LIPKEY Caller Specified anon_req_flag as FALSE . . . . 10
3.2.4. Other operations . . . . . . . . . . . . . . . . . . . . 11
3.3. Target . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3.1. GSS_Import_name . . . . . . . . . . . . . . . . . . . . 11
3.3.2. GSS_Acquire_cred . . . . . . . . . . . . . . . . . . . . 11
3.3.3. GSS_Accept_sec_context . . . . . . . . . . . . . . . . . 11
4. LIPKEY Description . . . . . . . . . . . . . . . . . . . . . 12
4.1. Mechanism Type . . . . . . . . . . . . . . . . . . . . . . 12
4.2. Name Types . . . . . . . . . . . . . . . . . . . . . . . . 12
4.3. Token Formats . . . . . . . . . . . . . . . . . . . . . . 12
4.3.1. Context Tokens . . . . . . . . . . . . . . . . . . . . . 12
4.3.1.1. Context Tokens Prior to SPKM-3 Context Establishment . 12
4.3.1.2. Post-SPKM-3 Context Establishment Token . . . . . . . 13
4.3.2. Tokens from GSS_GetMIC and GSS_Wrap . . . . . . . . . . 13
4.4. Quality of Protection . . . . . . . . . . . . . . . . . . 14
5. Security Considerations . . . . . . . . . . . . . . . . . . 15
5.1. Password Management . . . . . . . . . . . . . . . . . . . 15
5.2. Certificate Authorities . . . . . . . . . . . . . . . . . 15
References . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 17
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 17
Expires: December 1999 [Page 2]
INTERNET-DRAFT LIPKEY June 1999
1. Introduction
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
This memorandum describes a new security mechanism under the GSS-API
called the Low Infrastructure Public Key Mechanism (LIPKEY). GSS-API
provides a way for an application protocol to implement
authentication, integrity, and privacy. TLS is another way. While TLS
is in many ways simpler for an application to incorporate than GSS-
API, there are situations where GSS-API might be more suitable.
Certainly this is the case with application protocols that run over
connectionless protocols. It is also the case with application
protocols such as ONC RPC [RFC1831] [RFC2203], which have their own
security architecture, and so don't easily mesh with a protocol like
TLS that is implemented as a layer that encapsulates the upper layer
application protocol. GSS-API allows the application protocol to
encapsulate as much of the application protocol as necessary.
Despite the flexibility of GSS-API, it compares unfavorably with TLS
with respect to the perception of the amount of infrastructure
required to deploy it. The better known GSS-API mechanisms, Kerberos
V5 [RFC1964] and SPKM require a great deal of infrastructure to set
up. Compare this to the typical TLS deployment scenario, which
consists of a client with no public key certificate accessing a
server with a public key certificate. The client:
* obtains the server's certificate,
* verifies that it was signed by a trusted certificate authority
(CA),
* generates a random session symmetric key,
* encrypts the session key with the server's public key, and
* sends the encrypted session key to the server.
At this point, the client and server have a secure channel. The
client can then provide a user name and password to the server to
authenticate the client. For example, when TLS is being used with the
http protocol, once there is a secure channel, the http server will
present the client with an html page that prompts for a user name and
password. This information is then encrypted with the session key and
sent to the server. The server then authenticates the client.
Note that the client is not required to have a certificate to
Expires: December 1999 [Page 3]
INTERNET-DRAFT LIPKEY June 1999
identify and authenticate it to the server. The only security
infrastructure required, other than a TLS implementation, is a public
key certificate and password database on the server. Most operating
systems that the http server would run on already have a native
password database, so the net additional infrastructure is a server
certificate. Hence the term "low infrastructure security model" to
identify this typical TLS deployment scenario.
By using unilateral authentication, and using a mechanism resembling
the SPKM-1 mechanism type, SPKM can offer many aspects of the
previously described low infrastructure security model. An
application that uses GSS-API is certainly free to use GSS-API's
GSS_Wrap() routine to encrypt a user name and password and send them
to the server, for it to decrypt and verify.
Applications often have application protocols associated with them,
and there might not be any provision in the protocol to specify a
password. Layering a thin GSS-API mechanism over a mechanism
resembling SPKM-1 can mitigate this problem. This can be a useful
approach to avoid versioning applications that have already bound to
GSS-API, assuming the applications have not been written to
statically bind to specific GSS-API mechanisms. The remainder of
this memorandum defines the thin mechanism: the Low Infrastructure
Public Key Mechanism (LIPKEY).
2. LIPKEY's Requirements of SPKM
SPKM-1 with unilateral authentication is close to the desired low
infrastructure model described earlier. This section describes some
additional changes to how SPKM-1 operates in order to realize the low
infrastructure model. These changes include some minor changes in
semantics. While it would be possible to implement these semantic
changes within an SPKM-1 implementation (including using the same
mechanism type OID as SPKM-1), the set of changes stretch the
interpretation of RFC 2025 to the point where compatibility would be
in danger. A new mechanism type, called SPKM-3, is warranted. LIPKEY
requires that the SPKM implementation support SPKM-3. SPKM-3 is
equivalent to SPKM-1, except as described in the remainder of this
section.
2.1. Mechanism Type
SPKM-3 has a different mechanism type OID from SPKM-1. The SPKM-3
message type's OID is not yet defined.
2.2. Name Type
RFC 2025 defines no required name types of SPKM. LIPKEY requires that
Expires: December 1999 [Page 4]
INTERNET-DRAFT LIPKEY June 1999
the SPKM-3 implementation support all the mechanism independent name
types in RFC 2078.
2.3. Algorithms
RFC 2025 defines various algorithms for integrity, confidentiality,
key establishment, and subkey derivation. SPKM is designed to be
extensible with regard to new algorithms. In order for LIPKEY to work
correctly and securely, the following algorithms MUST be implemented
in SPKM-3:
* Integrity algorithms (I-ALG)
NULL-MAC
Because the initiator may not have a certificate for itself,
nor for the target, it is not possible for it to calculate an
Integrity value in the initiator's REQ-TOKEN that is sent to
the target. So we define, in ASN.1 [CCITT] syntax, a null I-
ALG that returns a zero length bit string regardless of the
input passed to it:
NULL-MAC OBJECT IDENTIFIER ::= {
-- OID to be defined
}
DES-MAC
The other consequence of the initiator not having a
certificate is that it cannot use the md5WithRSAEncryption
integrity algorithm. RFC 2025 notes that the DES-MAC I-ALG
is RECOMMENDED. LIPKEY must have a MAC algorithm present in
SPKM-3, and so SPKM-3 implementations MUST support the DES-
MAC I-ALG.
md5WithRSAEncryption
We still need, and so continue to REQUIRE,
md5WithRSAEncryption for the checksumming of the target's
context token.
Note that due to intellectual property considerations, a
future revision of this internet draft may mandate another
integrity algorithm in place of md5WithRSAEncryption,
although it is anticipated md5WithRSAEncryption will still be
RECOMMENDED.
* Confidentiality algorithm (C-ALG).
RFC 2025 does not have a MANDATORY confidentiality algorithm,
Expires: December 1999 [Page 5]
INTERNET-DRAFT LIPKEY June 1999
and instead has RECOMMENDED a 56 bit DES algorithm. Since the
LIPKEY initiator needs to send a password to the target, and
since 56 bit DES has been demonstrated as inadequate [EFF],
LIPKEY needs stronger encryption. Thus, SPKM-3 MUST support this
triple DES algorithm:
DES-EDE3-CBC OBJECT IDENTIFIER ::= {
iso(1) member-body(2) US(840) rsadsi(113549)
encryptionAlgorithm(3) 7
}
The reference for the algorithm OID of the DES-EDE3-CBC
algorithm is [RSA]. The reference for the algorithm's
description is believed to be [X9.52].
* Key Establishment Algorithm (K-ALG)
RFC 2025 lists dhKeyAgreement [PKCS-3] as an apparently optional
algorithm. As will be described later, the required
RSAEncryption key establishment algorithm is of no use for a low
infrastructure security mechanism as defined by this memorandum.
Hence, in SPKM-3, dhKeyAgreement is a REQUIRED key establishment
algorithm:
dhKeyAgreement OBJECT IDENTIFIER ::= {
iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1)
pkcs-3(3) 1
}
The REQUIRED Key Establishment (K-ALG), Integrity (I-ALG) and One-Way
Functions for Subkey Derivation (O-ALG) algorithms listed in RFC 2025
continue to be REQUIRED.
2.4. Context Establish Tokens
RFC 2025 sets up a context with an initiator first token (REQ-TOKEN),
a target reply (REP-TI-TOKEN), and finally an initiator second token
(REP-TI-TOKEN) to reply to the target's reply. Since LIPKEY uses
SPKM-3 with unilateral authentication, the REP-TI-TOKEN is not used.
LIPKEY has certain requirements on the contents of the REQ-TOKEN and
REP-TI-TOKEN, but the syntax of the SPKM-3 tokens is not different
from RFC 2025's SPKM-1 tokens.
2.4.1. REQ-TOKEN Content Requirements
Expires: December 1999 [Page 6]
INTERNET-DRAFT LIPKEY June 1999
2.4.1.1. algId and req-integrity
If the SPKM-3 initiator cannot calculate a req-integrity field due to
the lack of a target certificate, it MUST use the NULL-MAC I-ALG
described earlier in this memorandum. This will produce a zero length
bit string in the Integrity field.
2.4.1.2. Req-contents
Because RFC 2025 requires that the RSAEncryption K-ALG be present,
SPKM-1 must be able to map the target (targ-name) to its public key
certificate, and thus SPKM can use the RSAEncryption algorithm to
fill in the key-estb-req field. Because LIPKEY assumes a low
infrastructure deployment, SPKM-3 MUST be prepared to be unable to
map the targ-name field of the Req-contents field. This is a
contradiction which is resolved by requiring SPKM-3 to support the
dhKeyAgreement algorithm. Note that if an SPKM-3 implementation tries
to map the target to a certificate, and succeeds, it is free to use
the RSAEncryption K-ALG algorithm. It is also free to use an algID
other than NULL-MAC in the REQ-TOKEN type.
2.4.1.2.1. Options
SPKM-3 implementations MUST set the target-certif-data-required bit
to 1 if the only K-ALG in the key-estb-set field of Req-contents is
dhKeyAgreement. This would normally occur if the SPKM-3
implementation cannot resolve the target name to a certificate.
2.4.1.2.2. Conf-Algs
If the SPKM-3 implementation supports an algorithm weaker than DES-
EDE3-CBC, DES-EDE3-CBC MUST be listed before the weaker algorithms to
encourage the target to negotiate the stronger algorithm.
2.4.1.2.3. Intg-Algs
Because the initiator will be anonymous (at the SPKM-3 level) and
will not have a certificate for itself, the initiator cannot use an
integrity algorithm that supports non-repudiation.
2.4.2. REP-TI-TOKEN Content Requirements
With the previously described requirements on REQ-TOKEN, the contents
of SPKM-3's REP-TI-TOKEN can for the most part be derived from the
specification in RFC 2025. The exceptions are the algId and rep-ti-
integ fields.
Expires: December 1999 [Page 7]
INTERNET-DRAFT LIPKEY June 1999
2.4.2.1. algId
The SPKM-3 target MUST NOT use a NULL-MAC I-ALG; it MUST use
md5WithRSAEncryption. Note that this may change in a future revision
of this internet draft due to intellectual property issues.
2.4.2.2. rep-ti-integ
If the req-token has an algId of NULL-MAC, then the target MUST
compute the rep-ti-integ on the concatenation of the req-contents and
rep-ti-contents.
3. How LIPKEY Uses SPKM
3.1. Tokens
LIPKEY will invoke SPKM-3 to produce SPKM tokens. Since the mechanism
that the application uses is LIPKEY, LIPKEY will wrap some of the
SPKM-3 tokens with LIPKEY prefixes. The exact definition of the
tokens is described later in this memorandum.
3.2. Initiator
3.2.1. GSS_Import_name
The initiator uses GSS_Import_name to import the target's name,
typically, but not necessarily, using the GSS_C_NT_HOSTBASED_SERVICE
name type. Ultimately, the output of GSS_Import_name will apply to
an SPKM-3 mechanism type because a LIPKEY target is an SPKM-3 target.
3.2.2. GSS_Acquire_cred
The initiator calls GSS_Acquire_cred. The credentials that are
acquired are LIPKEY credentials, a user name and password. How the
user name and password is acquired is dependent upon the operating
environment. A application that invokes GSS_Acquire_cred() while the
application's user has a graphical user interface running might
trigger the appearance of a pop up window that prompts for the
information. A application embedded into the operating system, such
as an NFS [Sandberg] client implemented as a native file system might
broadcast a message to the user's terminals telling him to invoke a
command that prompts for the information.
3.2.3. GSS_Init_sec_context
When a program invokes GSS_Init_sec_context on the LIPKEY mechanism
Expires: December 1999 [Page 8]
INTERNET-DRAFT LIPKEY June 1999
type, if the context handle is NULL, the LIPKEY mechanism will in
turn invoke GSS_Init_sec_context on an SPKM-3 mechanism implemented
according to the requirements described previously. This call to
SPKM-3 MUST have the following attributes:
* claimant_cred_handle is NULL
* mutual_req_flag is FALSE
* anon_req_flag is TRUE
* input_token is NULL
* mech_type is the OID of the SPKM-3 mechanism
Keep in mind the above attributes are in the GSS_Init_sec_context
call from the LIPKEY mechanism down to the SPKM-3 mechanism. There
are no special restrictions placed on the application invoking
LIPKEY's GSS_Init_sec_context routine. All other arguments are
derived from the LIPKEY GSS_Init_sec_context arguments.
The call to the SPKM-3 GSS_Init_sec_context will create an SPKM-3
context handle. The remainder of the description of the LIPKEY
GSS_Init_sec_context call depends on whether the caller of the LIPKEY
GSS_Init_sec_context sets anon_req_flag to TRUE or FALSE.
3.2.3.1. LIPKEY Caller Specified anon_req_flag as TRUE
If the caller of LIPKEY's GSS_Init_sec_context sets anon_req_flag to
TRUE, it MUST return to the LIPKEY caller all the outputs from the
SPKM-3 GSS_Init_sec_context call, including the
output_context_handle, output_token, and mech_type. In this way,
LIPKEY now "gets out of the way" of GSS-API processing between the
application and SPKM-3, because nothing in the returned outputs
relates to LIPKEY. This is necessary, because LIPKEY context tokens
do not have provision for specifying anonymous initiators. This is
because SPKM-3 is sufficient for purpose of supporting anonymous
initiators in a low infrastructure environment.
Clearly, when the LIPKEY caller desires anonymous authentication,
LIPKEY does not add any value, but it is simpler to support the
feature, than to insist the caller directly use SPKM-3.
If all goes well, the caller of LIPKEY will be returned a major
status of GSS_S_CONTINUE_NEEDED via SPKM-3, and so the caller of
LIPKEY will send the output_token to the target. The caller of
LIPKEY then receives the response token from the target, and directly
invokes the SPKM-3 GSS_Init_sec_context. Upon return, the major
Expires: December 1999 [Page 9]
INTERNET-DRAFT LIPKEY June 1999
status should be GSS_S_COMPLETE.
3.2.3.2. LIPKEY Caller Specified anon_req_flag as FALSE
The LIPKEY mechanism will need to allocate a context handle for
itself, and record in the LIPKEY context handle the SPKM-3 context
handle that was returned in the output_context_handle parameter from
the call to the SPKM-3 GSS_Init_sec_context routine. The LIPKEY
GSS_Init_sec_context routine will return in output_context_handle the
LIPKEY context handle, and in mech_type, the LIPKEY mechanism type.
The output_token is as defined later in this memorandum, in the
subsection entitled "Context Tokens Prior to SPKM-3 Context
Establishment." All the other returned outputs will be those that
the SPKM-3 GSS_Init_sec_context routine returned to LIPKEY. If all
went well, the SPKM-3 mechanism will have returned a major status of
GSS_S_CONTINUE_NEEDED.
The caller of the LIPKEY GSS_Init_sec_context routine will see a
major status of GSS_S_CONTINUE_NEEDED, and so the caller of LIPKEY
will send the output_token to the target. The caller of LIPKEY then
receives the target's response token, and invokes the LIPKEY
GSS_Init_sec_context routine for a second time. LIPKEY then invokes
the SPKM-3 GSS_Init_sec_context for a second time and upon return,
the major status should be GSS_S_COMPLETE.
While SPKM-3's context establishment is now complete, LIPKEY's
context establishment is not yet complete, because the initiator must
send to the target the user name and password that was passed to it
via the claimant_cred_handle on the first call to the LIPKEY
GSS_Init_sec_context routine. LIPKEY uses the established SPKM-3
context handle as the input to GSS_Wrap (with conf_req_flag set to
TRUE) to encrypt what the claimant_cred_handle refers to (user name
and password), and returns that as the output token to the caller of
LIPKEY (provided the conf_state output from call to the SPKM-3
GSS_Wrap is TRUE), along with a major status of
GSS_S_CONTINUE_NEEDED.
The caller of LIPKEY sends its second token to the target, and waits
for either a GSS_S_COMPLETE response from the target, indicating that
the user name and password was accepted, or an error indicating
rejection of the user name and password (GSS_NO_CRED), or some other
appropriate error.
The SPKM-3 context remains established while the LIPKEY context is
established. If the SPKM-3 context expires before the LIPKEY context
is destroyed, the LIPKEY implementation should expire the LIPKEY
context and return the appropriate error on the next GSS-API
operation.
Expires: December 1999 [Page 10]
INTERNET-DRAFT LIPKEY June 1999
3.2.4. Other operations
For other operations, the LIPKEY context acts as a pass through to
the SPKM-3 context. Operations that affect or inquire context state,
such as GSS_Delete_sec_context, GSS_Export_sec_context,
GSS_Import_sec_context, and GSS_Inquire_context will require a pass
through to the SPKM-3 context and a state modification of the LIPKEY
context.
3.3. Target
3.3.1. GSS_Import_name
As with the initiator, the imported name will be that of the target.
3.3.2. GSS_Acquire_cred
The acceptor calls the LIPKEY GSS_Acquire_cred routine to get a
credential for an SPKM-3 target, via the SPKM-3 GSS_Acquire_cred
routine. The desired_name is the output_name from GSS_Import_name.
3.3.3. GSS_Accept_sec_context
When a program invokes GSS_Accept_sec_context on the LIPKEY mechanism
type, if the context handle is NULL, the LIPKEY mechanism will in
turn invoke GSS_Accept_sec_context on an SPKM-3 mechanism implemented
according the requirements described previously. This call to SPKM-3
is no different than what one would expect for a layered call to
GSS_Accept_sec_context.
If all goes well, the SPKM-3 GSS_Accept_sec_context call succeeds
with GSS_S_COMPLETE, and the LIPKEY GSS_Accept_sec_context call
returns the output_token to the caller, but with a major status of
GSS_S_CONTINUE_NEEDED because the LIPKEY initiator is still expected
to send the user name and password.
Once the SPKM-3 context is in a GSS_S_COMPLETE state, the next token
the target receives will contain the user name and password, wrapped
by the output of an SPKM-3 GSS_Wrap call. The target invokes the
LIPKEY GSS_Accept_sec_context, which in turn invokes the SPKM-3
GSS_Unwrap routine. The LIPKEY GSS_Accept_sec_context routine then
compares the user name and password with its user name name and
password database. If the initiator's user name and password are
valid, GSS_S_COMPLETE is returned to the caller. Otherwise
GSS_NO_CRED is returned. In either case, a zero length output_token
is returned to the caller. The target should send the major status
to the initiator and expect no more context tokens for that context.
Expires: December 1999 [Page 11]
INTERNET-DRAFT LIPKEY June 1999
4. LIPKEY Description
4.1. Mechanism Type
The Object Identifier for LIPKEY is to be defined.
4.2. Name Types
LIPKEY uses only the mechanism independent name types defined in RFC
2078. All the name types defined in RFC 2078 are REQUIRED.
4.3. Token Formats
4.3.1. Context Tokens
GSS-API defines the context tokens as:
InitialContextToken ::=
-- option indication (delegation, etc.) indicated within
-- mechanism-specific token
[APPLICATION 0] IMPLICIT SEQUENCE {
thisMech MechType,
innerContextToken ANY DEFINED BY thisMech
-- contents mechanism-specific
-- ASN.1 structure not required
}
SubsequentContextToken ::= innerContextToken ANY
-- interpretation based on predecessor InitialContextToken
-- ASN.1 structure not required
The contents of the innerContextToken depend on whether the SPKM-3
context is established or not.
4.3.1.1. Context Tokens Prior to SPKM-3 Context Establishment
In a LIPKEY InitialContextToken, thisMech will be the Object
identifier for LIPKEY. However, as long as LIPKEY has not
established the SPKM-3 mechanism, the innerContextToken for both the
InitialContextToken and the SubsequentContextToken will be the output
of an SPKM-3 GSS_Init_sec_context or GSS_Accept_sec_context. So the
LIPKEY innerContextToken would be either:
* An InitialContextToken, with thisMech set to the object
identifier for SPKM-3, with innerContextToken defined to be an
SPKMInnerContextToken, as defined in RFC 2025.
Expires: December 1999 [Page 12]
INTERNET-DRAFT LIPKEY June 1999
* A SubsequentContextToken, with innerContextToken defined to be
SPKMInnerContextToken
4.3.1.2. Post-SPKM-3 Context Establishment Token
Once the SPKM-3 context is established, there is just one token sent
from the initiator to the target, and no token returned to initiator.
This token is the result of a GSS_Wrap (conf_req is set to TRUE) of a
user name and password by the SPKM-3 context. This is the SPKM-WRAP
token and is partially reproduced here from RFC 2025:
SPKM-WRAP ::= SEQUENCE {
wrap-header Wrap-Header,
wrap-body Wrap-Body
}
Wrap-Body ::= SEQUENCE {
int-cksum BIT STRING,
-- Checksum of header and data,
-- calculated according to
-- algorithm specified in int-alg
-- field of wrap-header
data BIT STRING
-- encrypted data.
}
The "data" field of Wrap-Body is contains the result of encrypting
this type:
UserName-Password ::= SEQUENCE {
user-name OCTET STRING,
-- each octet is an octet of a
-- UTF-8 [RFC2279] string
password OCTET STRING
-- each octet is an octet of a
-- UTF-8 [RFC2279] string
}
4.3.2. Tokens from GSS_GetMIC and GSS_Wrap
RFC 2078 defines the token emitted by GSS_GetMIC and GSS_Wrap as:
PerMsgToken ::=
-- as emitted by GSS_GetMIC and processed by GSS_VerifyMIC
-- ASN.1 structure not required
innerMsgToken ANY
Expires: December 1999 [Page 13]
INTERNET-DRAFT LIPKEY June 1999
SealedMessage ::=
-- as emitted by GSS_Wrap and processed by GSS_Unwrap
-- includes internal, mechanism-defined indicator
-- of whether or not encrypted
-- ASN.1 structure not required
sealedUserData ANY
As one can see, there are no mechanism independent prefixes in
PerMSGToken or SealedMessage, and no explicit mechanism specific
information either. Since LIPKEY doesn't add any value to GSS_GetMIC
and GSS_Wrap other than passing the message to the SPKM-3 GSS_GetMIC
and GSS_Wrap, LIPKEY's PerMsgToken and SealedMessage tokens are
exactly what SPKM-3's GSS_GetMIC and GSS_Wrap routines produce.
4.4. Quality of Protection
LIPKEY, being a pass through for GSS_Wrap and GSS_GetMIC to SPKM-3,
doesn't interpret or alter the QOPs passed to the aforementioned
routines or received from their complements, GSS_Unwrap, and
GSS_VerifyMIC. This LIPKEY supports the same set of QOPs as SPKM-3.
The SPKM-3 initiator and target negotiate the set of algorithms they
mutually support, using the procedure defined in Section 5.2 of RFC
2025. If a QOP of zero is specified, then the initiator and target
will use the first C-ALG (privacy), and I-ALG integrity algorithm
negotiated.
SPKM breaks the QOP into several fields, as reproduced here from
Section 5.2 of RFC 2025:
Confidentiality Integrity
31 (MSB) 16 15 (LSB) 0
-------------------------------|-------------------------------
| TS(5) | U(3) | IA(4) | MA(4) | TS(5) | U(3) | IA(4) | MA(4) |
-------------------------------|-------------------------------
The MA subfields enumerate mechanism-defined algorithms. Since this
memorandum introduces a new mechanism, SPKM-3, within the SPKM
family, it is appropriate to add the triple DES algorithm in the MA
subfield of the Confidentiality field. The complete set of
Confidentiality MA algorithms is thus:
0001 (1) = DES-CBC
0010 (2) = DES-EDE3-CBC
Where "0001" and "0010" are in base 2. Adding support for DES-EDE3-
CBC in the above manner to SPKM-1 and SPKM-2 does not impair SPKM-1
and SPKM-2 backward compatibility because, as noted previously, SPKM
Expires: December 1999 [Page 14]
INTERNET-DRAFT LIPKEY June 1999
negotiates algorithms. An older SPKM-1 or SPKM-2 that doesn't
recognize DES-EDE3-CBC won't select it.
5. Security Considerations
5.1. Password Management
LIPKEY sends the clear text password encrypted by triple DES, so the
risk in this approach is in how the target manages the password after
it is done with it. The approach should be safe, provided the target
clears the memory (primary and secondary, such as disk) buffers that
contained the password, and any hash of the password immediately
after it has verified the user's password.
5.2. Certificate Authorities
The initiator must have a list of trusted Certificate Authorities in
order to verify the checksum on the SPKM-3 target's context reply
token. If it encounters a certificate signed by an unknown and/or
untrusted certificate authority, the initiator MUST NOT silently
accept the certificate. If it does wish to accept the certificate, it
MUST get confirmation from the user running the application that is
using GSS-API.
Expires: December 1999 [Page 15]
INTERNET-DRAFT LIPKEY June 1999
References
[CCITT] CCITT (1988). "Recommendation X.208: Specification of
Abstract Syntax Notation One (ASN.1)"
[EFF]
Electronic Frontier Foundation, John Gilmore (Editor),
(1998). "Cracking Des: Secrets of Encryption Research,
Wiretap Politics & Chip Design". O'Reilly & Associates,
ISBN 1565925203.
[PKCS-3]
RSA Laboratories (1993). "PKCS #3: Diffie-Hellman Key-
Agreement Standard, Version 1.4,"
ftp://ftp.rsa.com/pub/pkcs/ascii/pkcs-3.asc
[RSA]
S/MIME Editor, RSA Data Security, Inc. (1995). "S/MIME
Implementation Guide Interoperability Profile, Version 1."
ftp://ftp.rsa.com/pub/S-MIME/smimeimp.txt
[Sandberg]
Sandberg, R., Goldberg, D., Kleiman, S., Walsh, D., Lyon,
B.. (1985). "Design and Implementation of the Sun Network
Filesystem," Proceedings of the 1985 Summer USENIX
Technical Conference.
[RFC1831] Srinivasan, R. (1995). "RPC: Remote Procedure Call Protocol
Specification Version 2," RFC 1831.
http://info.internet.isi.edu/in-notes/rfc/files/rfc1831.txt
[RFC1832] Srinivasan, R. (1995). "XDR: External Data Representation
Standard," RFC 1832.
http://info.internet.isi.edu/in-notes/rfc/files/rfc1832.txt
[RFC2203] Eisler, M., Chiu, A., Ling L. (1997). "RPCSEC_GSS Protocol
Specification," RFC 2203.
http://info.internet.isi.edu/in-notes/rfc/files/rfc2203.txt
[RFC2025] Adams, C. (1996). "The Simple Public-Key GSS-API Mechanism
(SPKM)," RFC 2025.
http://info.internet.isi.edu/in-notes/rfc/files/rfc2025.txt
[RFC2078] Linn, J. (1997). "Generic Security Service Application
Program Interface, Version 2," RFC 2078.
http://info.internet.isi.edu/in-notes/rfc/files/rfc2078.txt
Expires: December 1999 [Page 16]
INTERNET-DRAFT LIPKEY June 1999
[RFC2119] Bradner, S. (1997). "Key words for use in RFCs to Indicate
Requirement Levels," RFC 2119.
http://info.internet.isi.edu/in-notes/rfc/files/rfc2119.txt
[RFC2246] T. Dierks, C. Allen (1999). "The TLS Protocols Version
1.0," RFC 2246.
http://info.internet.isi.edu/in-notes/rfc/files/rfc2246.txt
[RFC2279] Yergeau, F. (1998), "UTF-8, a transformation format of ISO
10646", RFC2279,
http://info.internet.isi.edu/in-notes/rfc/files/rfc2279.txt
[X9.52] American National Standards Institute (1996) ANSI Draft
X9.52. "Triple Data Encryption Algorithms Modes of
Operations," Revision 6.0.
Acknowledgments
The author thanks and acknowledges:
* Jack Kabat for his patient explanation of the intricacies of
SPKM, his excellent suggestions, and review comments.
* Denis Pinkas for his review comments.
* This memorandum includes ASN.1 definitions for GSS-API tokens
from RFC 2078, which was authored by John Linn.
* This memorandum includes ASN.1 definitions and other text from
the SPKM definition in RFC 2025, which was authored by Carlisle
Adams.
Author's Address
Address comments related to this memorandum to:
cat-ietf@mit.edu
Mike Eisler
Sun Microsystems, Inc.
5565 Wilson Road
Colorado Springs, CO 80919
Phone: 1-719-599-9026
E-mail: mre@eng.sun.com
Expires: December 1999 [Page 17]
| PAFTECH AB 2003-2026 | 2026-04-23 06:04:04 |