Skip to main content

A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism
RFC 7802

Revision differences

Document history

Date Rev. By Action
2018-12-20
02 (System)
Received changes through RFC Editor sync (changed abstract to 'This document defines the Pseudo-Random Function (PRF) for the Kerberos V mechanism for the Generic Security …
Received changes through RFC Editor sync (changed abstract to 'This document defines the Pseudo-Random Function (PRF) for the Kerberos V mechanism for the Generic Security Service Application Program Interface (GSS-API), based on the PRF defined for the Kerberos V cryptographic framework, for keying application protocols given an established Kerberos V GSS-API security context.

This document obsoletes RFC 4402 and reclassifies that document as Historic. RFC 4402 starts the PRF+ counter at 1; however, a number of implementations start the counter at 0. As a result, the original specification would not be interoperable with existing implementations.')
2016-03-03
02 (System) RFC published
2016-03-02
02 (System) RFC Editor state changed to AUTH48-DONE from AUTH48
2016-02-22
02 (System) RFC Editor state changed to AUTH48 from RFC-EDITOR
2016-02-15
02 (System) RFC Editor state changed to RFC-EDITOR from EDIT
2015-12-21
02 (System) IANA Action state changed to No IC from In Progress
2015-12-21
02 (System) RFC Editor state changed to EDIT
2015-12-21
02 (System) IESG state changed to RFC Ed Queue from Approved-announcement sent
2015-12-21
02 (System) Announcement was received by RFC Editor
2015-12-21
02 (System) IANA Action state changed to In Progress
2015-12-21
02 Amy Vezza IESG state changed to Approved-announcement sent from Approved-announcement to be sent
2015-12-21
02 Amy Vezza IESG has approved the document
2015-12-21
02 Amy Vezza Closed "Approve" ballot
2015-12-21
02 Amy Vezza Ballot approval text was generated
2015-12-21
02 Amy Vezza Ballot writeup was changed
2015-12-17
02 Cindy Morgan IESG state changed to Approved-announcement to be sent from IESG Evaluation
2015-12-17
02 Spencer Dawkins [Ballot Position Update] New position, No Objection, has been recorded for Spencer Dawkins
2015-12-17
02 Alvaro Retana [Ballot Position Update] New position, No Objection, has been recorded for Alvaro Retana
2015-12-17
02 Jari Arkko [Ballot Position Update] New position, No Objection, has been recorded for Jari Arkko
2015-12-17
02 Brian Haberman [Ballot Position Update] New position, No Objection, has been recorded for Brian Haberman
2015-12-16
02 Joel Jaeggli [Ballot comment]
sue hares performed the ospdir review resulting in changes reflected in version 2
2015-12-16
02 Joel Jaeggli [Ballot Position Update] New position, No Objection, has been recorded for Joel Jaeggli
2015-12-16
02 Alia Atlas [Ballot Position Update] New position, No Objection, has been recorded for Alia Atlas
2015-12-16
02 Deborah Brungard [Ballot Position Update] New position, No Objection, has been recorded for Deborah Brungard
2015-12-16
02 Ben Campbell [Ballot comment]
I would have found a "changes from 4402" section helpful.

I concur with Barry's comment concerning obsoleting vs changing to historical.
2015-12-16
02 Ben Campbell [Ballot Position Update] New position, No Objection, has been recorded for Ben Campbell
2015-12-16
02 Barry Leiba
[Ballot comment]
There is one thing I'd like to discuss here (lower-case "discuss"):

  This document obsoletes RFC 4402 and reclassifies that document as
  …
[Ballot comment]
There is one thing I'd like to discuss here (lower-case "discuss"):

  This document obsoletes RFC 4402 and reclassifies that document as
  historic.

We don't have a clear sense of what "historic" means and how it interacts with "obsolete", so let me start with how I look at it:
I think that a newer version of a protocol specification makes the old version of that protocol obsolete.
I think that a protocol (but not a version) that is no longer recommended for use might become historic.
I think that if we have a protocol called ABCDP, and we make a new protocol called LMNOP that replaces ABCDP, we might likely make ABCDP historic.
I think that if we then have an updated version of LMNOP, that obsoletes the earlier version... but it doesn't make it historic.

So I question whether the "reclassifies as historic" is the right thing here or not.  4402 will be marked "obsolete", and that should be enough.
2015-12-16
02 Barry Leiba Ballot comment text updated for Barry Leiba
2015-12-16
02 Benoît Claise [Ballot Position Update] New position, No Objection, has been recorded for Benoit Claise
2015-12-15
02 Terry Manderson [Ballot Position Update] New position, No Objection, has been recorded for Terry Manderson
2015-12-15
02 Barry Leiba [Ballot Position Update] New position, No Objection, has been recorded for Barry Leiba
2015-12-14
02 Martin Stiemerling [Ballot Position Update] New position, No Objection, has been recorded for Martin Stiemerling
2015-12-14
02 (System) IANA Review state changed to IANA OK - No Actions Needed from Version Changed - Review Needed
2015-12-13
02 Alissa Cooper [Ballot Position Update] New position, No Objection, has been recorded for Alissa Cooper
2015-12-12
02 Gunter Van de Velde Request for Last Call review by OPSDIR Completed: Has Nits. Reviewer: Susan Hares.
2015-12-11
02 Shawn Emery IANA Review state changed to Version Changed - Review Needed from IANA OK - No Actions Needed
2015-12-11
02 Shawn Emery New version available: draft-ietf-kitten-rfc4402bis-02.txt
2015-12-10
01 Stephen Farrell Ballot has been issued
2015-12-10
01 Stephen Farrell [Ballot Position Update] New position, Yes, has been recorded for Stephen Farrell
2015-12-10
01 Stephen Farrell Created "Approve" ballot
2015-12-10
01 Stephen Farrell Ballot writeup was changed
2015-12-10
01 Stephen Farrell IESG state changed to IESG Evaluation from Waiting for Writeup
2015-12-10
01 Stephen Farrell Changed consensus to Yes from Unknown
2015-12-04
01 (System) IESG state changed to Waiting for Writeup from In Last Call
2015-12-03
01 Tero Kivinen Request for Last Call review by SECDIR Completed: Ready. Reviewer: Charlie Kaufman.
2015-12-01
01 (System) IANA Review state changed to IANA OK - No Actions Needed from IANA - Review Needed
2015-12-01
01 Sabrina Tanamal
(Via drafts-lastcall-comment@iana.org): IESG/Authors/WG Chairs:

IANA has reviewed draft-ietf-kitten-rfc4402bis-01.txt, which is currently in Last Call, and has the following comments:

We understand that this …
(Via drafts-lastcall-comment@iana.org): IESG/Authors/WG Chairs:

IANA has reviewed draft-ietf-kitten-rfc4402bis-01.txt, which is currently in Last Call, and has the following comments:

We understand that this document doesn't require any IANA actions.

IANA notes that the authors suggest that: "If and when a relevant IANA registry of GSS-API symbols and constants is created, then the GSS_KRB5_S_KG_INPUT_TOO_LONG minor status code should be added to such a registry." IANA understands this as a reminder to future authors of such a draft and not as an action for IANA to complete.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, IANA does not object.

If this assessment is not accurate, please respond as soon as possible.
2015-12-01
01 Christer Holmberg Request for Last Call review by GENART Completed: Ready. Reviewer: Christer Holmberg.
2015-11-29
01 Gunter Van de Velde Request for Last Call review by OPSDIR is assigned to Susan Hares
2015-11-29
01 Gunter Van de Velde Request for Last Call review by OPSDIR is assigned to Susan Hares
2015-11-26
01 Tero Kivinen Request for Last Call review by SECDIR is assigned to Charlie Kaufman
2015-11-26
01 Tero Kivinen Request for Last Call review by SECDIR is assigned to Charlie Kaufman
2015-11-24
01 Stephen Farrell Placed on agenda for telechat - 2015-12-17
2015-11-23
01 Jean Mahoney Request for Last Call review by GENART is assigned to Christer Holmberg
2015-11-23
01 Jean Mahoney Request for Last Call review by GENART is assigned to Christer Holmberg
2015-11-20
01 Cindy Morgan IANA Review state changed to IANA - Review Needed
2015-11-20
01 Cindy Morgan
The following Last Call announcement was sent out:

From: The IESG
To: "IETF-Announce"
CC: kitten-chairs@ietf.org, draft-ietf-kitten-rfc4402bis@ietf.org, "Benjamin Kaduk" , kitten@ietf.org, kaduk@mit.edu, …
The following Last Call announcement was sent out:

From: The IESG
To: "IETF-Announce"
CC: kitten-chairs@ietf.org, draft-ietf-kitten-rfc4402bis@ietf.org, "Benjamin Kaduk" , kitten@ietf.org, kaduk@mit.edu, stephen.farrell@cs.tcd.ie
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (A Pseudo-Random Function (PRF) for the Kerberos V Generic Security Service Application Program Interface (GSS-API) Mechanism) to Proposed Standard


The IESG has received a request from the Common Authentication Technology
Next Generation WG (kitten) to consider the following document:
- 'A Pseudo-Random Function (PRF) for the Kerberos V Generic Security
  Service Application Program Interface (GSS-API) Mechanism'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2015-12-04. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  This document defines the Pseudo-Random Function (PRF) for the
  Kerberos V mechanism for the Generic Security Service Application
  Program Interface (GSS-API), based on the PRF defined for the
  Kerberos V cryptographic framework, for keying application protocols
  given an established Kerberos V GSS-API security context.

  This document obsoletes RFC 4402 and reclassifies that document as
  historic.  RFC 4402 starts the PRF+ counter at 1, however a number of
  implementations starts the counter at 0.  As a result, the original
  specification would not be interoperable with existing
  implementations.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc4402bis/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-kitten-rfc4402bis/ballot/


No IPR declarations have been submitted directly on this I-D.


2015-11-20
01 Cindy Morgan IESG state changed to In Last Call from Last Call Requested
2015-11-20
01 Stephen Farrell Last call was requested
2015-11-20
01 Stephen Farrell Ballot approval text was generated
2015-11-20
01 Stephen Farrell Ballot writeup was generated
2015-11-20
01 Stephen Farrell IESG state changed to Last Call Requested from AD Evaluation
2015-11-20
01 Stephen Farrell Last call announcement was generated
2015-11-20
01 Stephen Farrell IESG state changed to AD Evaluation from Publication Requested
2015-11-19
01 Benjamin Kaduk
1. Summary

Benjamin Kaduk is the document shepherd.  Stephen Farrell is the
responsible Area Director.

This document is necessary because implementors of RFC 4402 erred …
1. Summary

Benjamin Kaduk is the document shepherd.  Stephen Farrell is the
responsible Area Director.

This document is necessary because implementors of RFC 4402 erred
when implementing the PRF+ construct, starting the counter variable
at zero instead of one.  The error was present in multiple releases
of a shipping implementation when a second implementor discovered
the error in interoperability testing; that second implementor also
started the counter variable at zero for compatibility.  This document
serves to update RFC 4402 and reflect the implementation reality
that is deployed and functioning interoperably.  It is being published
as a Standards Track document to match RFC 4402 which it replaces,
as is consistent with most work on Kerberos in the IETF.


2. Review and Consensus

There is strong consensus for this document, which only differs from
RFC 4402 in the change of the initial value of the counter variable
and the removal of an unneeded and confusing paragraph from the
security considerations section.  It also adds test vectors, which
have been verified by two implementations (MIT and Heimdal Kerberos).
The WGLC period was part of a combined WGLC for three "bis" documents,
over a period of four weeks.  Most of the prominent WG contributors
reviewed the document, and no substantive issues were found (though
a couple of regressions from RFC 4402 were noted and fixed).


3. Intellectual Property

There are no intellectual property disclosures against this document,
and both authors have confirmed conformance with BCPs 78 and 79.


4. Other Points

There are no downrefs and no IANA considerations (since there is no
IANA registry for the GSS-API namespace or error codes specified
in the document).  The document is a little old (some 200-odd days,
as noted by idnits), due to the shepherd being preoccupied due to
moving residences and employment.

There is one erratum against RFC 4402, the issue that this document
is intended to resolve.
2015-11-19
01 Benjamin Kaduk Responsible AD changed to Stephen Farrell
2015-11-19
01 Benjamin Kaduk IETF WG state changed to Submitted to IESG for Publication from In WG Last Call
2015-11-19
01 Benjamin Kaduk IESG state changed to Publication Requested
2015-11-19
01 Benjamin Kaduk IESG process started in state Publication Requested
2015-11-19
01 Benjamin Kaduk Intended Status changed to Proposed Standard from None
2015-11-19
01 Benjamin Kaduk Changed document writeup
2015-11-18
01 Benjamin Kaduk Notification list changed to "Benjamin Kaduk" <kaduk@mit.edu>
2015-11-18
01 Benjamin Kaduk Document shepherd changed to Benjamin Kaduk
2015-10-14
01 (System) Notify list changed from draft-ietf-kitten-rfc4402bis.shepherd@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-rfc4402bis@ietf.org, draft-ietf-kitten-rfc4402bis.ad@ietf.org to (None)
2015-05-26
00 Cindy Morgan Notification list changed to draft-ietf-kitten-rfc4402bis.shepherd@ietf.org, kitten-chairs@ietf.org, draft-ietf-kitten-rfc4402bis@ietf.org, draft-ietf-kitten-rfc4402bis.ad@ietf.org
2015-05-25
01 Shawn Emery New version available: draft-ietf-kitten-rfc4402bis-01.txt
2015-01-20
00 Benjamin Kaduk IETF WG state changed to In WG Last Call from WG Document
2014-04-28
00 Cindy Morgan New revision available