Description of PKINIT

(As of http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-25.txt)

[  Common symbols  |  PKINIT with fresh DH  |  PKINIT with reused DH  |  PKINIT with public-key encryption  |  Mapping to specs  ]

Common Symbols

See also the mapping to the specifications

Principals: C  Client
 K  Key Authentication Server (KAS)
 T  Ticket Granting Server (TGS)
 
Keys: skC  Client secret signature key
 skK  KAS secret signature key
 AK  Authentication key (symmetric, shared between Client and TGS)
 k  Temporary key (symmetric, shared between Client and KAS, protects AK, replaces password-derived kC of [CLAR])
 kT  Long term symmetric key shared between KAS and TGS
 
Certificates: CertC  Client certificates
 TrustC  Client's trusted Certification Authorities (CAs)
 CertPath Certificate path followed by KAS to validate client's credentials
 CertK  KAS certificates
 
Nonces: n1,n2  Nonces generated by Client
 
Timestamps: tC  Timestamp generated by Client
 tK  Timestamp generated by KAS
 
Operations: m1,m2 Concatenation of m1 and m2
 [m]sk Signature of m with secret key sk (corresponds to SignedData, i.e., abstracts both eContent and SignerInfo fields)
 {m}k Encryption of m with key sk (symmetric or asymmetric)


PKINIT with fresh Diffie-Hellman key distribution

 Additional Symbols:
Diffie-Hellman data: DHpar  Domain parameters
 DHpubC  Public value of Client
 DHprvC  Private value of Client
 DHpubK  Public value of KAS
 DHprvK  Private value of KAS
 DHsecret Shared secret (generated from DHpubC and DHprvK by KAS, and from DHpubK and DHprvC by Client)

(see also the mapping to the specifications)

Process: 
C: generate (DHprvC, DHpubC)
C --> K: CertC, [tC,n2,DHpar,DHpubC]skC, TrustC, C, T, n1
K: generate (DHprvK, DHpubK)
   compute DHsecret using DHpubC and DHprvK
   compute k = Hash(DHsecret)
   generate AK
K --> C: CertK, [DHpubK,n2]skK, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k
C: compute DHsecret using DHpubK and DHprvC
   compute k = Hash(DHsecret)
Messages: 
C                                                                     K
           CertC, [tC,n2,DHpar,DHpubC]skC, TrustC, C, T, n1            
---------------------------------------------------------------------->
                                                                      |
     CertK, [DHpubK,n2]skK, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k    |
<----------------------------------------------------------------------


PKINIT with reused Diffie-Hellman keys

 Additional Symbols:
Diffie-Hellman data: DHpubC Cached Client public value
 DHpubK Cached KAS Public value
 DHsecret Cached shared secret
 
Nonces: nC  Nonce generated by Client
 nK Nonce generated by KAS
 
Timestamps: tDH Expiration time provided by KAS

(see also the mapping to the specifications)

Process: 
C: generate nC
C --> K: CertC, [tC,n2,DHpar,DHpubC,nC]skC, TrustC, C, T, n1
K: lookup (DHpubC, DHpubK, DHsecret)
   generate nK
   compute k = Hash(DHsecret, nC, nK)
   generate AK
K --> C: CertK, [DHpubK,0,nK,tDH]skK, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k
C: compute k = Hash(DHsecret, nC, nK)
Messages: 
C                                                                            K
             CertC, [tC,n2,DHpar,DHpubC,nC]skC, TrustC, C, T, n1              
----------------------------------------------------------------------------->
                                                                             |
     CertK, [DHpubK,0,nK,tDH]skK, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k     |
<-----------------------------------------------------------------------------


PKINIT with server-generated key distribution

 Additional Symbols:
 
Keys: pkC Public key of Client

(see also the mapping to the specifications)

Process: 
C --> K: CertC, [tC,n2]skC, TrustC, C, T, n1
K: generate k
   generate AK
K --> C: {CertK, [k,n2]skK}pkC, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k
Messages: 
C                                                                  K
               CertC, [tC,n2]skC, TrustC, C, T, n1                  
------------------------------------------------------------------->
                                                                   |
   {CertK, [k,n2]skK}pkC, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k   |
<-------------------------------------------------------------------

PKINIT with server-generated key distribution - ATTACK

 Process: 
C --> K: CertC, [tC,n2]skC, TrustC, C, T, n1
I: intercep
I --> K: CertI, [tC,n2]skI, TrustI, I, T, n1 
K: generate k
   generate AK
K --> I: {CertK, [k,n2]skK}pkI, I, {AK,I,tK,CertPath}kT, {AK,n1,tK,T}k
I --> C: {CertK, [k,n2]skK}pkC, C, {AK,I,tK,CertPath}kT, {AK,n1,tK,T}k
Messages: 
C                                                                  I                                                                  K
          CertC, [tC,n2]skC, TrustC, C, T, n1                                                                                          
------------------------------------------------------------------->                                                                   
                                                                   |                                                                   
                                                                   |              CertI, [tC,n2]skI, TrustI, I, T, n1                  
                                                                   ------------------------------------------------------------------->
                                                                                                                                      |
                                                                      {CertK, [k,n2]skK}pkI, I, {AK,I,tK,CertPath}kT, {AK,n1,tK,T}k   |
                                                                   <-------------------------------------------------------------------
                                                                   |                                                                   
   {CertK, [k,n2]skK}pkC, C, {AK,I,tK,CertPath}kT, {AK,n1,tK,T}k   |                                                                   
<-------------------------------------------------------------------

PKINIT with server-generated key distribution - Larry Zhu's fix

 Additional Symbols:
 
Checksums: cksm Checksum over AS_REQ

Process: 
C --> K: CertC, [tC,n2]skC, TrustC, C, T, n1
K: generate k
   generate AK
   compute cksm = KEYED-CHECKSUM(k, 6, (CertC, [tC,n2]skC, TrustC, C, T, n1))
K --> C: {CertK, [k,cksm]skK}pkC, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k
Messages: 
C                                                                    K
                CertC, [tC,n2]skC, TrustC, C, T, n1                   
--------------------------------------------------------------------->
                                                                     |
   {CertK, [k,cksm]skK}pkC, C, {AK,C,tK,CertPath}kT, {AK,n1,tK,T}k   |
<---------------------------------------------------------------------
Comments: