Subject: GSS PRF diffs

From: Nicolas Williams <[email-masked]>
Date: Mon, 18 Apr 2005 21:43:20 -0500

Below are the changes to draft-ietf-kitten-gssapi-prf-02 and
draft-ietf-kitten-krb5-gssapi-prf-02, excluding all formatting and
boilerplate changes, for:

 - IANA considerations
 - missing Introduction section

 - New GSS_Pseudo_random() inut parameter, 'prf_key' and three
   constants, GSS_C_PRF_KEY_DEFAULT/PARTIAL/OTHER, and an informative
   reference to RFC1964/CFX.

 - Java and C# bindings of GSS_Pseudo_random()

 - Proper alignment with RFC3961 (removed text about key usages)

 - Changed reference for kcrypto from I-D to RFC3961

The only change I haven't yet made is a clarifying change that Jeff
asked for relating to the maximum and minimum desired_output_len that
must be supported.

The diffs, then:

--- kitten-gss-prf-02.txt	Fri Feb 11 15:36:49 2005
+++ kitten-gss-prf-03.txt	Mon Apr 18 18:23:57 2005
@@
 Table of Contents
 
    1.  Conventions used in this document  . . . . . . . . . . . . . .  3
    2.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  4
    3.  GSS_Pseudo_random()  . . . . . . . . . . . . . . . . . . . . .  5
    3.1 C-Bindings . . . . . . . . . . . . . . . . . . . . . . . . . .  6
-   4.  Security Considerations  . . . . . . . . . . . . . . . . . . .  7
-   5.  References . . . . . . . . . . . . . . . . . . . . . . . . . .  8
-   5.1 Normative References . . . . . . . . . . . . . . . . . . . . .  8
-   5.2 Informative References . . . . . . . . . . . . . . . . . . . .  8
-       Author's Address . . . . . . . . . . . . . . . . . . . . . . .  8
-       Intellectual Property and Copyright Statements . . . . . . . .  9
+   3.2 Java Bindings  . . . . . . . . . . . . . . . . . . . . . . . .  7
+   3.3 C# Bindings  . . . . . . . . . . . . . . . . . . . . . . . . .  7
+   4.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  8
+   5.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
+   6.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
+   6.1 Normative References . . . . . . . . . . . . . . . . . . . . . 10
+   6.2 Informative References . . . . . . . . . . . . . . . . . . . . 10
+       Author's Address . . . . . . . . . . . . . . . . . . . . . . . 10
...
@@
 3.  GSS_Pseudo_random()
 
    Inputs:
 
    o  context CONTEXT handle,
+   o  prf_key INTEGER,
    o  prf_in OCTET STRING,
    o  desired_output_len INTEGER
 
    Outputs:
 
    o  major_status INTEGER,
    o  minor_status INTEGER,
    o  prf_out OCTET STRING
 
    Return major_status codes:

    o  GSS_S_COMPLETE indicates no error.
    o  GSS_S_NO_CONTEXT indicates that a null context has been provided
       as input.
    o  GSS_S_CONTEXT_EXPIRED indicates that an expired context has been
       provided as input.
    o  GSS_S_UNAVAILABLE indicates that the mechanism lacks support for
       this function or, if the security context is not fully
       established, that the context is not ready to compute the PRF.
    o  GSS_S_FAILURE indicates failure or lack of support; the minor
       status code may provide additional information.
 
    This function applies the established context's mechanism's keyed PRF
-   function to the input data (prf_in), keyed with key material
-   associated with the given security context and outputs the resulting
-   octet string (prf_out) of desired_output_len length.
+   function, using the desired 'prf_key', to the input data ('prf_in'),
+   keyed with key material associated with the given security context
+   and outputs the resulting octet string ('prf_out') of
+   desired_output_len length.
 
+   The prf_key can take on the following values: GSS_C_PRF_KEY_DEFAULT,
+   GSS_C_PRF_KEY_PARTIAL and GSS_C_PRF_KEY_OTHER.  This parameter is
+   intended to identify a key to use when the PRF operation is called on
+   a partially established security context by one peer and on a fully-
+   established security context by the other peer -- in some mechanisms,
+   such as the Kerberos V GSS-API mechanism [RFC1964], this cannot be
+   avoided when a the GSS_Pseudo_random() operation is needed pre-full
+   security context establishment.  The GSS_C_PRF_KEY_DEFAULT value
+   corresponds to the best key available at the time that
+   GSS_Pseudo_random() is caller.  GSS_C_PRF_KEY_PARTIAL corresponds to
+   a key that would be have been used while the security context is
+   partially established, even if it is fully established when
+   GSS_Pseudo_random() is called.  GSS_C_PRF_KEY_OTHER is intended to
+   refer to one other possible key, but mechanisms which may make more
+   than three keys available for use with GSS_Pseudo_random() must
+   provide other, mechanism-specific values for prk_key.
+
    The output string of this function MUST be a pseudo-random function
    [GGM1][GGM2] of the input keyed with key material from the
    established security context -- the chances of getting the same
    output given different input parameters should be exponentially
    small.
 
    This function, applied to the same inputs by an initiator and
-   acceptor using the same established context, MUST produce the *same
-   results* for both, the initiator and acceptor, even if called
+   acceptor using the same established context, MUST produce the _same
+   results_ for both, the initiator and acceptor, even if called
    multiple times for the same context.
 
@@ 
 3.1  C-Bindings
 
+   #define GSS_C_PRF_KEY_DEFAULT 0
+   #define GSS_C_PRF_KEY_PARTIAL 1
+   #define GSS_C_PRF_KEY_OTHER   2
+
    OM_uint32 gss_pseudo_random(
      OM_uint32               *minor_status,
      gss_ctx_id_t            context,
+     int                     prf_key,
      const gss_buffer_t      prf_in,
      ssize_t                 desired_output_len,
      gss_buffer_t            prf_out
    );

+3.2  Java Bindings
 
+   For Java GSS_Pseudo_random() maps to a GSSContext method, 'prf':
 
+   public static final int GSS_C_PRF_KEY_DEFAULT = 0
+   public static final int GSS_C_PRF_KEY_PARTIAL = 1
+   public static final int GSS_C_PRF_KEY_OTHER   = 2
 
+   public byte[] prf(int prf_key, byte inBuf[], int outlen)
+      throws GSSException

+3.3  C# Bindings
 
+   For C# GSS_Pseudo_random() maps to a GSSContext method, 'prf':
 
+   public static final int GSS_C_PRF_KEY_DEFAULT = 0
+   public static final int GSS_C_PRF_KEY_PARTIAL = 1
+   public static final int GSS_C_PRF_KEY_OTHER   = 2
 
+   public byte[] prf(int prf_key, byte inBuf[], int outlen)
@@
+4.  IANA Considerations
 
-4.  Security Considerations
+   This document has no IANA considerations.
 
+5.  Security Considerations
+
    Care should be taken in properly designing a mechanism's PRF
    function.
 
    GSS mechanisms' PRF functions should use a key derived from contexts'
    session keys and should preserve the forward security properties of
@@
-5.  References
+6.  References
 
-5.1  Normative References
+6.1  Normative References
@@
-5.2  Informative References
+6.2  Informative References
@@
+   [RFC1964]  Linn, J., "The Kerberos Version 5 GSS-API Mechanism",
+              RFC 1964, June 1996.
@@

--- draft-ietf-kitten-krb5-gssapi-prf-02.txt
+++ draft-ietf-kitten-krb5-gssapi-prf-03.txt
@@
 Table of Contents
 
    1. Conventions used in this document  . . . . . . . . . . . . . . . 3
-   2. Kerberos V GSS Mechanism PRF . . . . . . . . . . . . . . . . . . 4
-   3. Security Considerations  . . . . . . . . . . . . . . . . . . . . 5
-   4. Normative References . . . . . . . . . . . . . . . . . . . . . . 5
+   2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 3
+   3. Kerberos V GSS Mechanism PRF . . . . . . . . . . . . . . . . . . 3
+   4. IANA Considerations  . . . . . . . . . . . . . . . . . . . . . . 4
+   5. Security Considerations  . . . . . . . . . . . . . . . . . . . . 4
+   6. Normative References . . . . . . . . . . . . . . . . . . . . . . 4
       Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 5
@@
+2.  Introduction
 
+   This document specifies the Kerberos V GSS-API mechanism's pseudo-
+   random funtion corresponding to [GSS-PRF].  The function is a "PRF+"
+   style construction.
 
-2.  Kerberos V GSS Mechanism PRF
+3.  Kerberos V GSS Mechanism PRF
 
    The GSS-API PRF [GSS-PRF] function for the Kerberos V mechanism [CFX]
    shall be the output of a PRF+ function based on the enctype's PRF
    function keyed with the negotiated session key of the security
-   context and key usage X (TBD).
+   context.
 
    The security context MUST be fully established, else the mechanism
    MUST fail with GSS_S_UNAVAILABLE as the major status code and
    GSS_KRB5_S_KG_CTX_INCOMPLETE as the minor status code.
 
-   This PRF+ MUST be keyed with a key derived, with key usage (TBD),
-   from the session used by the initiator and acceptor, after the
-   security context is fully established, to derive keys for per-message
-   tokens.  For the current Kerberos V mechanism [CFX] this means that
-   the PRF+ MUST be keyed with the acceptor-asserted subkey, if it did
-   assert such a key, or the initiator's sub-session key otherwise.
+   This PRF+ MUST be keyed with the key indicated by the 'prf_key' input
+   parameter as follows:
 
+   o  GSS_C_PRF_KEY_DEFAULT -- use the sub-session key asserted by the
+      acceptor, if any, or the sub-session asserted by the initiator, if
+      any, or the Ticket's session key
+
+   o  GSS_C_PRF_KEY_PARTIAL -- use the sub-session key asserted by the
+      initiator, if any, or the Ticket's session key
+
+   o  GSS_C_PRF_KEY_OTHER -- use the Ticket's session key
+
    The PRF+ function is a simple counter-based extension of the Kerberos
-   V pseudo-random function [KRB5-CRYPTO] for the enctype of the
-   security context's keys:
+   V pseudo-random function [RFC3961] for the enctype of the security
+   context's keys:
 
    	PRF+(K, L, S) = truncate(L, T1 || T2 || .. || Tn)
 
-   	Tn = pseudo-random-function(K, n || S)
+         Tn = pseudo-random(K, n || S)
 
-   	where '||' is the concatenation operator, 'n' is encoded as a
-   	network byte order 32-bit unsigned binary number, and where
-   	truncate(L, S) truncates the input octet string S to length L.
+   where '||' is the concatenation operator, 'n' is encoded as a network
+   byte order 32-bit unsigned binary number, truncate(L, S) truncates
+   the input octet string S to length L, and pseudo-random() is the
+   Kerberos V pseudo-random function [RFC3961].
 
    The maximum output size of the Kerberos V mechanism's GSS-API PRF
    then is, necessarily, 2^32 octets.
 
    Implementations MUST support output size of up to 2^14 octets at
@@
+4.  IANA Considerations
 
+   This document has no IANA considerations.
 
-3.  Security Considerations
+5.  Security Considerations
@@
-4  Normative References
+6.  Normative References
@@
-   [KRB5-CRYPTO]
-              Raeburn, K., "Encryption and Checksum Specifications for
-              Kerberos 5".
+   [RFC3961]  Raeburn, K., "Encryption and Checksum Specifications for
+              Kerberos 5", RFC 3961, February 2005.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 18 Apr 2005 21:43:53 -0500

These are proposed changes, of course.  Please review, comment.