1 2 3 4 5 6 7Network Working Group Assar Westerlund 8<draft-ietf-cat-krb5-tcp.txt> SICS 9Internet-Draft Johan Danielsson 10November, 1997 PDC, KTH 11Expire in six months 12 13 Kerberos over TCP 14 15Status of this Memo 16 17 This document is an Internet-Draft. Internet-Drafts are working 18 documents of the Internet Engineering Task Force (IETF), its areas, 19 and its working groups. Note that other groups may also distribute 20 working documents as Internet-Drafts. 21 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or obsoleted by other documents at any 24 time. It is inappropriate to use Internet- Drafts as reference 25 material or to cite them other than as "work in progress." 26 27 To view the entire list of current Internet-Drafts, please check the 28 "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow 29 Directories on ftp.is.co.za (Africa), ftp.nordu.net (Europe), 30 munnari.oz.au (Pacific Rim), ds.internic.net (US East Coast), or 31 ftp.isi.edu (US West Coast). 32 33 Distribution of this memo is unlimited. Please send comments to the 34 <cat-ietf@mit.edu> mailing list. 35 36Abstract 37 38 This document specifies how the communication should be done between 39 a client and a KDC using Kerberos [RFC1510] with TCP as the transport 40 protocol. 41 42Specification 43 44 This draft specifies an extension to section 8.2.1 of RFC1510. 45 46 A Kerberos server MAY accept requests on TCP port 88 (decimal). 47 48 The data sent from the client to the KDC should consist of 4 bytes 49 containing the length, in network byte order, of the Kerberos 50 request, followed by the request (AS-REQ or TGS-REQ) itself. The 51 reply from the KDC should consist of the length of the reply packet 52 (4 bytes, network byte order) followed by the packet itself (AS-REP, 53 TGS-REP, or KRB-ERROR). 54 55 56 57 58Westerlund, Danielsson [Page 1] 59 60Internet Draft Kerberos over TCP November, 1997 61 62 63 C->S: Open connection to TCP port 88 at the server 64 C->S: length of request 65 C->S: AS-REQ or TGS-REQ 66 S->C: length of reply 67 S->C: AS-REP, TGS-REP, or KRB-ERROR 68 69Discussion 70 71 Even though the preferred way of sending kerberos packets is over UDP 72 there are several occasions when it's more practical to use TCP. 73 74 Mainly, it's usually much less cumbersome to get TCP through 75 firewalls than UDP. 76 77 In theory, there's no reason for having explicit length fields, that 78 information is already encoded in the ASN1 encoding of the Kerberos 79 packets. But having explicit lengths makes it unnecessary to have to 80 decode the ASN.1 encoding just to know how much data has to be read. 81 82 Another way of signaling the end of the request of the reply would be 83 to do a half-close after the request and a full-close after the 84 reply. This does not work well with all kinds of firewalls. 85 86Security considerations 87 88 This memo does not introduce any known security considerations in 89 addition to those mentioned in [RFC1510]. 90 91References 92 93 [RFC1510] Kohl, J. and Neuman, C., "The Kerberos Network 94 Authentication Service (V5)", RFC 1510, September 1993. 95 96Authors' Addresses 97 98 Assar Westerlund 99 Swedish Institute of Computer Science 100 Box 1263 101 S-164 29 KISTA 102 Sweden 103 104 Phone: +46-8-7521526 105 Fax: +46-8-7517230 106 EMail: assar@sics.se 107 108 Johan Danielsson 109 PDC, KTH 110 S-100 44 STOCKHOLM 111 112 113 114Westerlund, Danielsson [Page 2] 115 116Internet Draft Kerberos over TCP November, 1997 117 118 119 Sweden 120 121 Phone: +46-8-7907885 122 Fax: +46-8-247784 123 EMail: joda@pdc.kth.se 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170Westerlund, Danielsson [Page 3] 171 172