}
tempkey = key_correction(add_parity_bits(tempstring));
key = key_correction(DES-CBC-check(s,tempkey));
return(key);
}
des_string_to_key(string,salt,params) {
if (length(params) == 0)
type = 0;
else if (length(params) == 1)
type = params[0];
else
error("invalid params");
if (type == 0)
mit_des_string_to_key(string,salt);
else
error("invalid params");
}
One common extension is to support the "AFS string-to-key" algorithm,
which is not defined here, if the type value above is one (1).
For generation of a key from a random bitstring, we start with a 56-
bit string and, as with the string-to-key operation above, insert
parity bits. If the result is a weak or semi-weak key, we modify it
by eXclusive-OR with the constant 0x00000000000000F0:
des_random_to_key(bitstring) {
return key_correction(add_parity_bits(bitstring));
}
6.2.1. DES with MD5
The des-cbc-md5 encryption mode encrypts information under DES in CBC
mode with an all-zero initial vector and with an MD5 checksum
(described in [MD5-92]) computed and placed in the checksum field.
The encryption system parameters for des-cbc-md5 are as follows:
des-cbc-md5
--------------------------------------------------------------------
protocol key format 8 bytes, parity in low bit of each
specific key structure copy of original key
required checksum rsa-md5-des
mechanism
key-generation seed 8 bytes
length
cipher state 8 bytes (CBC initial vector)
initial cipher state all-zero
encryption function des-cbc(confounder | checksum | msg | pad,
ivec=oldstate)
where
checksum = md5(confounder | 0000...
| msg | pad)
newstate = last block of des-cbc output
decryption function decrypt encrypted text and verify checksum
newstate = last block of ciphertext
des-cbc-md5
--------------------------------------------------------------------
default string-to-key empty string
params
pseudo-random function des-cbc(md5(input-string), ivec=0)
key generation functions:
string-to-key des_string_to_key
random-to-key des_random_to_key
key-derivation identity
The des-cbc-md5 encryption type is assigned the etype value three
(3).
6.2.2. DES with MD4
The des-cbc-md4 encryption mode also encrypts information under DES
in CBC mode, with an all-zero initial vector. An MD4 checksum
(described in [MD4-92]) is computed and placed in the checksum field.
des-cbc-md4
--------------------------------------------------------------------
protocol key format 8 bytes, parity in low bit of each
specific key structure copy of original key
required checksum rsa-md4-des
mechanism
key-generation seed 8 bytes
length
cipher state 8 bytes (CBC initial vector)
initial cipher state all-zero
encryption function des-cbc(confounder | checksum | msg | pad,
ivec=oldstate)
where
checksum = md4(confounder | 0000...
| msg | pad)
newstate = last block of des-cbc output
des-cbc-md4
--------------------------------------------------------------------
decryption function decrypt encrypted text and verify checksum
newstate = last block of ciphertext
default string-to-key empty string
params
pseudo-random function des-cbc(md5(input-string), ivec=0)
key generation functions:
string-to-key des_string_to_key
random-to-key copy input, then fix parity bits
key-derivation identity
Note that des-cbc-md4 uses md5, not md4, in the PRF definition.
The des-cbc-md4 encryption algorithm is assigned the etype value two
(2).
6.2.3. DES with CRC
The des-cbc-crc encryption type uses DES in CBC mode with the key
used as the initialization vector, with a four-octet CRC-based
checksum computed as described in section 6.1.3. Note that this is
not a standard CRC-32 checksum, but a slightly modified one.
des-cbc-crc
--------------------------------------------------------------------
protocol key format 8 bytes, parity in low bit of each
specific key structure copy of original key
required checksum rsa-md5-des
mechanism
key-generation seed 8 bytes
length
cipher state 8 bytes (CBC initial vector)
des-cbc-crc
--------------------------------------------------------------------
initial cipher state copy of original key
encryption function des-cbc(confounder | checksum | msg | pad,
ivec=oldstate)
where
checksum = crc(confounder | 00000000
| msg | pad)
newstate = last block of des-cbc output
decryption function decrypt encrypted text and verify checksum
newstate = last block of ciphertext
default string-to-key empty string
params
pseudo-random function des-cbc(md5(input-string), ivec=0)
key generation functions:
string-to-key des_string_to_key
random-to-key copy input, then fix parity bits
key-derivation identity
The des-cbc-crc encryption algorithm is assigned the etype value one
(1).
6.2.4. RSA MD5 Cryptographic Checksum Using DES
The RSA-MD5-DES checksum calculates a keyed collision-proof checksum
by prepending an eight octet confounder before the text, applying the
RSA MD5 checksum algorithm, and encrypting the confounder and the
checksum by using DES in cipher-block-chaining (CBC) mode with a
variant of the key, where the variant is computed by eXclusive-ORing
the key with the hexadecimal constant 0xF0F0F0F0F0F0F0F0. The
initialization vector should be zero. The resulting checksum is 24
octets long.
rsa-md5-des
----------------------------------------------------------------
associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc
get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0,
conf | rsa-md5(conf | msg))
verify_mic decrypt and verify rsa-md5 checksum
The rsa-md5-des checksum algorithm is assigned a checksum type number
of eight (8).
6.2.5. RSA MD4 Cryptographic Checksum Using DES
The RSA-MD4-DES checksum calculates a keyed collision-proof checksum
by prepending an eight octet confounder before the text, applying the
RSA MD4 checksum algorithm [MD4-92], and encrypting the confounder
and the checksum using DES in cipher-block-chaining (CBC) mode with a
variant of the key, where the variant is computed by eXclusive-ORing
the key with the constant 0xF0F0F0F0F0F0F0F0 [7]. The initialization
vector should be zero. The resulting checksum is 24 octets long.
rsa-md4-des
----------------------------------------------------------------
associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc
get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0,
conf | rsa-md4(conf | msg),
ivec=0)
verify_mic decrypt and verify rsa-md4 checksum
The rsa-md4-des checksum algorithm is assigned a checksum type number
of three (3).
6.2.6. RSA MD4 Cryptographic Checksum Using DES Alternative
The RSA-MD4-DES-K checksum calculates a keyed collision-proof
checksum by applying the RSA MD4 checksum algorithm and encrypting
the results by using DES in cipher block chaining (CBC) mode with a
DES key as both key and initialization vector. The resulting
checksum is 16 octets long. This checksum is tamper-proof and
believed to be collision-proof. Note that this checksum type is the
old method for encoding the RSA-MD4-DES checksum; it is no longer
recommended.
rsa-md4-des-k
----------------------------------------------------------------
associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc
get_mic des-cbc(key, md4(msg), ivec=key)
verify_mic decrypt, compute checksum and compare
The rsa-md4-des-k checksum algorithm is assigned a checksum type
number of six (6).
6.2.7. DES CBC Checksum
The DES-MAC checksum is computed by prepending an eight octet
confounder to the plaintext, padding with zero-valued octets if
necessary to bring the length to a multiple of eight octets,
performing a DES CBC-mode encryption on the result by using the key
and an initialization vector of zero, taking the last block of the
ciphertext, prepending the same confounder, and encrypting the pair
by using DES in cipher-block-chaining (CBC) mode with a variant of
the key, where the variant is computed by eXclusive-ORing the key
with the constant 0xF0F0F0F0F0F0F0F0. The initialization vector
should be zero. The resulting checksum is 128 bits (sixteen octets)
long, 64 bits of which are redundant. This checksum is tamper-proof
and collision-proof.
des-mac
---------------------------------------------------------------------
associated des-cbc-md5, des-cbc-md4, des-cbc-crc
cryptosystem
get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0,
conf | des-mac(key, conf | msg | pad, ivec=0),
ivec=0)
verify_mic decrypt, compute DES MAC using confounder, compare
The des-mac checksum algorithm is assigned a checksum type number of
four (4).
6.2.8. DES CBC Checksum Alternative
The DES-MAC-K checksum is computed by performing a DES CBC-mode
encryption of the plaintext, with zero-valued padding bytes if
necessary to bring the length to a multiple of eight octets, and by
using the last block of the ciphertext as the checksum value. It is
keyed with an encryption key that is also used as the initialization
vector. The resulting checksum is 64 bits (eight octets) long. This
checksum is tamper-proof and collision-proof. Note that this
checksum type is the old method for encoding the DESMAC checksum; it
is no longer recommended.
des-mac-k
----------------------------------------------------------------
associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc
get_mic des-mac(key, msg | pad, ivec=key)
verify_mic compute MAC and compare
The des-mac-k checksum algorithm is assigned a checksum type number
of five (5).
6.3. Triple-DES Based Encryption and Checksum Types
This encryption and checksum type pair is based on the Triple DES
cryptosystem in Outer-CBC mode and on the HMAC-SHA1 message
authentication algorithm.
A Triple DES key is the concatenation of three DES keys as described
above for des-cbc-md5. A Triple DES key is generated from random
data by creating three DES keys from separate sequences of random
data.
Encrypted data using this type must be generated as described in
section 5.3. If the length of the input data is not a multiple of
the block size, zero-valued octets must be used to pad the plaintext
to the next eight-octet boundary. The confounder must be eight
random octets (one block).
The simplified profile for Triple DES, with key derivation as defined
in section 5, is as follows:
des3-cbc-hmac-sha1-kd, hmac-sha1-des3-kd
------------------------------------------------
protocol key format 24 bytes, parity in low
bit of each
key-generation seed 21 bytes
length
des3-cbc-hmac-sha1-kd, hmac-sha1-des3-kd
------------------------------------------------
hash function SHA-1
HMAC output size 160 bits
message block size 8 bytes
default string-to-key empty string
params
encryption and triple-DES encrypt and
decryption functions decrypt, in outer-CBC
mode (cipher block size
8 octets)
key generation functions:
random-to-key DES3random-to-key (see
below)
string-to-key DES3string-to-key (see
below)
The des3-cbc-hmac-sha1-kd encryption type is assigned the value
sixteen (16). The hmac-sha1-des3-kd checksum algorithm is assigned a
checksum type number of twelve (12).
6.3.1. Triple DES Key Production (random-to-key, string-to-key)
The 168 bits of random key data are converted to a protocol key value
as follows. First, the 168 bits are divided into three groups of 56
bits, which are expanded individually into 64 bits as follows:
DES3random-to-key:
1 2 3 4 5 6 7 p
9 10 11 12 13 14 15 p
17 18 19 20 21 22 23 p
25 26 27 28 29 30 31 p
33 34 35 36 37 38 39 p
41 42 43 44 45 46 47 p
49 50 51 52 53 54 55 p
56 48 40 32 24 16 8 p
The "p" bits are parity bits computed over the data bits. The output
of the three expansions, each corrected to avoid "weak" and "semi-
weak" keys as in section 6.2, are concatenated to form the protocol
key value.
The string-to-key function is used to transform UTF-8 passwords into
DES3 keys. The DES3 string-to-key function relies on the "N-fold"
algorithm and DK function, described in section 5.
The n-fold algorithm is applied to the password string concatenated
with a salt value. For 3-key triple DES, the operation will involve
a 168-fold of the input password string, to generate an intermediate
key, from which the user’s long-term key will be derived with the DK
function. The DES3 string-to-key function is shown here in
pseudocode:
DES3string-to-key(passwordString, salt, params)
if (params != emptyString)
error("invalid params");
s = passwordString + salt
tmpKey = random-to-key(168-fold(s))
key = DK (tmpKey, KerberosConstant)
Weak key checking is performed in the random-to-key and DK
operations. The KerberosConstant value is the byte string {0x6b 0x65
0x72 0x62 0x65 0x72 0x6f 0x73}. These values correspond to the ASCII
encoding for the string "kerberos".
7. Use of Kerberos Encryption Outside This Specification
Several Kerberos-based application protocols and preauthentication
systems have been designed and deployed that perform encryption and
message integrity checks in various ways. Although in some cases
there may be good reason for specifying these protocols in terms of
specific encryption or checksum algorithms, we anticipate that in
many cases this will not be true, and more generic approaches
independent of particular algorithms will be desirable. Rather than
have each protocol designer reinvent schemes for protecting data,
using multiple keys, etc., we have attempted to present in this
section a general framework that should be sufficient not only for
the Kerberos protocol itself but also for many preauthentication
systems and application protocols, while trying to avoid some of the
assumptions that can work their way into such protocol designs.
Some problematic assumptions we’ve seen (and sometimes made) include
the following: a random bitstring is always valid as a key (not true
for DES keys with parity); the basic block encryption chaining mode
provides no integrity checking, or can easily be separated from such
checking (not true for many modes in development that do both
simultaneously); a checksum for a message always results in the same
value (not true if a confounder is incorporated); an initial vector
is used (may not be true if a block cipher in CBC mode is not in
use).
Although such assumptions the may hold for any given set of
encryption and checksum algorithms, they may not be true of the next
algorithms to be defined, leaving the application protocol unable to
make use of those algorithms without updates to its specification.
The Kerberos protocol uses only the attributes and operations
described in sections 3 and 4. Preauthentication systems and
application protocols making use of Kerberos are encouraged to use
them as well. The specific key and string-to-key parameters should
generally be treated as opaque. Although the string-to-key
parameters are manipulated as an octet string, the representation for
the specific key structure is implementation defined; it may not even
be a single object.
We don’t recommend doing so, but some application protocols will
undoubtedly continue to use the key data directly, even if only in
some of the currently existing protocol specifications. An
implementation intended to support general Kerberos applications may
therefore need to make the key data available, as well as the
attributes and operations described in sections 3 and 4 [8].
8. Assigned Numbers
The following encryption-type numbers are already assigned or
reserved for use in Kerberos and related protocols.
encryption type etype section or comment
-----------------------------------------------------------------
des-cbc-crc 1 6.2.3
des-cbc-md4 2 6.2.2
des-cbc-md5 3 6.2.1
[reserved] 4
des3-cbc-md5 5
[reserved] 6
des3-cbc-sha1 7
dsaWithSHA1-CmsOID 9 (pkinit)
md5WithRSAEncryption-CmsOID 10 (pkinit)
sha1WithRSAEncryption-CmsOID 11 (pkinit)
rc2CBC-EnvOID 12 (pkinit)
rsaEncryption-EnvOID 13 (pkinit from PKCS#1 v1.5)
rsaES-OAEP-ENV-OID 14 (pkinit from PKCS#1 v2.0)
des-ede3-cbc-Env-OID 15 (pkinit)
des3-cbc-sha1-kd 16 6.3
aes128-cts-hmac-sha1-96 17 [KRB5-AES]
aes256-cts-hmac-sha1-96 18 [KRB5-AES]
rc4-hmac 23 (Microsoft)
rc4-hmac-exp 24 (Microsoft)
subkey-keymaterial 65 (opaque; PacketCable)
(The "des3-cbc-sha1" assignment is a deprecated version using no key
derivation. It should not be confused with des3-cbc-sha1-kd.)
Several numbers have been reserved for use in encryption systems not
defined here. Encryption-type numbers have unfortunately been
overloaded on occasion in Kerberos-related protocols, so some of the
reserved numbers do not and will not correspond to encryption systems
fitting the profile presented here.
The following checksum-type numbers are assigned or reserved. As