1 2 3 4KITTEN WG N. Williams 5Internet-Draft Sun 6Expires: April 19, 2006 October 16, 2005 7 8 9 Clarifications and Extensions to the GSS-API for the Use of Channel 10 Bindings 11 draft-ietf-kitten-gssapi-channel-bindings-01.txt 12 13Status of this Memo 14 15 By submitting this Internet-Draft, each author represents that any 16 applicable patent or other IPR claims of which he or she is aware 17 have been or will be disclosed, and any of which he or she becomes 18 aware will be disclosed, in accordance with Section 6 of BCP 79. 19 20 Internet-Drafts are working documents of the Internet Engineering 21 Task Force (IETF), its areas, and its working groups. Note that 22 other groups may also distribute working documents as Internet- 23 Drafts. 24 25 Internet-Drafts are draft documents valid for a maximum of six months 26 and may be updated, replaced, or obsoleted by other documents at any 27 time. It is inappropriate to use Internet-Drafts as reference 28 material or to cite them other than as "work in progress." 29 30 The list of current Internet-Drafts can be accessed at 31 http://www.ietf.org/ietf/1id-abstracts.txt. 32 33 The list of Internet-Draft Shadow Directories can be accessed at 34 http://www.ietf.org/shadow.html. 35 36 This Internet-Draft will expire on April 19, 2006. 37 38Copyright Notice 39 40 Copyright (C) The Internet Society (2005). 41 42Abstract 43 44 This document clarifies and generalizes the GSS-API "channel 45 bindings" facility. This document also specifies the format of the 46 various types of channel bindings. 47 48 49 50 51 52 53 54 55Williams Expires April 19, 2006 [Page 1] 56 57Internet-Draft GSS-API Channel Bindings October 2005 58 59 60Table of Contents 61 62 1. Conventions used in this document . . . . . . . . . . . . . . 3 63 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 64 3. Generic Structure for GSS-API Channel Bindings . . . . . . . . 5 65 3.1. Proper Mechanism Use of Channel Bindings . . . . . . . . . 5 66 4. Channel Bindings for SSHv2 . . . . . . . . . . . . . . . . . . 6 67 4.1. GSS_Make_sshv2_channel_bindings() . . . . . . . . . . . . 6 68 4.1.1. C-Bindings . . . . . . . . . . . . . . . . . . . . . . 7 69 5. Channel Bindings for TLS . . . . . . . . . . . . . . . . . . . 8 70 5.1. GSS_Make_tls_channel_bindings() . . . . . . . . . . . . . 8 71 5.1.1. C-Bindings . . . . . . . . . . . . . . . . . . . . . . 9 72 6. Channel Bindings for IPsec . . . . . . . . . . . . . . . . . . 10 73 6.1. GSS_Make_ipsec_channel_bindings() . . . . . . . . . . . . 10 74 6.1.1. C-Bindings . . . . . . . . . . . . . . . . . . . . . . 11 75 7. Security Considerations . . . . . . . . . . . . . . . . . . . 12 76 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 77 8.1. Normative . . . . . . . . . . . . . . . . . . . . . . . . 13 78 8.2. Informative . . . . . . . . . . . . . . . . . . . . . . . 13 79 Appendix A. Acknowledgments . . . . . . . . . . . . . . . . . . . 14 80 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 15 81 Intellectual Property and Copyright Statements . . . . . . . . . . 16 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111Williams Expires April 19, 2006 [Page 2] 112 113Internet-Draft GSS-API Channel Bindings October 2005 114 115 1161. Conventions used in this document 117 118 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 119 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 120 document are to be interpreted as described in [RFC2119]. 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167Williams Expires April 19, 2006 [Page 3] 168 169Internet-Draft GSS-API Channel Bindings October 2005 170 171 1722. Introduction 173 174 The concept of "channel bindings" and the abstract construction of 175 channel bindings for several types of channels are described in 176 [CHANNEL-BINDINGS] 177 178 To actually use channel bindings in GSS-API aplications additional 179 details are required that are given below. 180 181 First the structure given to channel bindings data in [RFC2744] is 182 generalized to all of the GSS-API, not just its C-Bindings. 183 184 Then the actual construction of channel bindings to SSHv2, TLS and 185 IPsec channels is given. 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223Williams Expires April 19, 2006 [Page 4] 224 225Internet-Draft GSS-API Channel Bindings October 2005 226 227 2283. Generic Structure for GSS-API Channel Bindings 229 230 The base GSS-API v2, update 1 specification [RFC2743]describes 231 channel bindings as an OCTET STRING and leaves it to the GSS-API v2, 232 update 1 C-Bindings specification to specify the structure of the 233 contents of the channel bindings OCTET STRINGs. The C-Bindings 234 specification [RFC2744]then defines, in terms of C, what should be 235 generic structure for channel bindings. The Kerberos V GSS mechanism 236 [RFC1964]then defines a method for encoding GSS channel bindings in a 237 way that is independent of the C-Bindings! 238 239 In other words, the structure of GSS channel bindings given in 240 [RFC2744] is actually generic, rather than specific to the C 241 programming language. 242 243 Here, then, is a generic re-statement of this structure, in pseudo- 244 ASN.1: 245 246 GSS-CHANNEL-BINDINGS := SEQUENCE { 247 initiator-address-type INTEGER, 248 initiator-address OCTET STRING, 249 acceptor-address-type INTEGER, 250 acceptor-address OCTET STRING, 251 application-data OCTET STRING, 252 } 253 254 The values for the address fields are described in [RFC2744]. 255 256 Language-specific bindings of the GSS-API should specify a language- 257 specific formulation of this structure. 258 2593.1. Proper Mechanism Use of Channel Bindings 260 261 As described in [CHANNEL-BINDINGS], GSS mechanisms should exchange 262 integrity protected proofs of channel bindings, where the proof is 263 obtained by running a strong hash of the channel bindings data 264 (encoded as per some mechanism-specific, such as in [RFC1964]) and a 265 binary value to represent the initiator->acceptor, and opposite, 266 direction. 267 268 The encoding of channel bindings used in [RFC1964], with the addition 269 of a binary value as described above, and the substitution of SHA-1 270 for MD5 is a reasonable, generic encoding of GSS-CHANNEL-BINDINGS 271 that any future GSS mechanisms can use. 272 273 274 275 276 277 278 279Williams Expires April 19, 2006 [Page 5] 280 281Internet-Draft GSS-API Channel Bindings October 2005 282 283 2844. Channel Bindings for SSHv2 285 286 The SSHv2 channel bindings are constructed as an octet string for the 287 'application-data' field of the channel bindings by concatenating the 288 following values and in this order: 289 290 1. The ASCII string "GSS SSHv2 CB:" 291 292 2. The SSHv2 session ID 293 294 3. Any additional application-provided data, encoded as the DER 295 encoding of an ASN.1 OCTET STRING 296 2974.1. GSS_Make_sshv2_channel_bindings() 298 299 Inputs: 300 301 302 o session_id OCTET STRING, 303 304 o additional_app_data OCTET STRING 305 306 Outputs: 307 308 309 o major_status INTEGER, 310 311 o minor_status INTEGER, 312 313 o channel_bindings_app_data OCTET STRING 314 315 Return major_status codes: 316 317 o GSS_S_COMPLETE indicates no error. 318 319 o GSS_S_FAILURE indicates failure to construct the channel bindings 320 as a result, perhaps, of a memory management, or similar failure. 321 322 This function constructs an OCTET STRING for use as the value of the 323 application-data field of the GSS-CHANNEL-BINDINGS structure 324 described above. 325 326 327 328 329 330 331 332 333 334 335Williams Expires April 19, 2006 [Page 6] 336 337Internet-Draft GSS-API Channel Bindings October 2005 338 339 3404.1.1. C-Bindings 341 342 OM_uint32 gss_make_sshv2_channel_bindings( 343 OM_uint32 *minor_status, 344 const gss_buffer_t session_id, 345 const gss_buffer_t additional_app_data, 346 gss_buffer_t channel_bindings_app_data 347 ); 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391Williams Expires April 19, 2006 [Page 7] 392 393Internet-Draft GSS-API Channel Bindings October 2005 394 395 3965. Channel Bindings for TLS 397 398 The TLS channel bindings are constructed as an octet string for the 399 'application-data' field of the channel bindings by concatenating the 400 following values and in this order: 401 402 1. The ASCII string "GSS TLSv1.0 CB:" 403 404 2. The TLS finished message sent by the client 405 406 3. The TLS finished message sent by the server 407 408 4. Any additional application-provided data, encoded as the DER 409 encoding of an ASN.1 OCTET STRING 410 4115.1. GSS_Make_tls_channel_bindings() 412 413 Inputs: 414 415 416 o client_finished_msg OCTET STRING, 417 418 o server_finished_msg OCTET STRING, 419 420 o additional_app_data OCTET STRING 421 422 Outputs: 423 424 425 o major_status INTEGER, 426 427 o minor_status INTEGER, 428 429 o channel_bindings_app_data OCTET STRING 430 431 Return major_status codes: 432 433 o GSS_S_COMPLETE indicates no error. 434 435 o GSS_S_FAILURE indicates failure to construct the channel bindings 436 as a result, perhaps, of a memory management, or similar failure. 437 438 This function constructs an OCTET STRING for use as the value of the 439 application-data field of the GSS-CHANNEL-BINDINGS structure 440 described above. 441 442 443 444 445 446 447Williams Expires April 19, 2006 [Page 8] 448 449Internet-Draft GSS-API Channel Bindings October 2005 450 451 4525.1.1. C-Bindings 453 454 OM_uint32 gss_make_tls_channel_bindings( 455 OM_uint32 *minor_status, 456 const gss_buffer_t client_finished_msg, 457 const gss_buffer_t server_finished_msg, 458 const gss_buffer_t additional_app_data, 459 gss_buffer_t channel_bindings_app_data 460 ); 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503Williams Expires April 19, 2006 [Page 9] 504 505Internet-Draft GSS-API Channel Bindings October 2005 506 507 5086. Channel Bindings for IPsec 509 510 The IPsec channel bindings are constructed as an octet string for the 511 'application-data' field of the channel bindings by concatenating the 512 following values and in this order: 513 514 515 1. The ASCII string "GSS IPsec CB:" 516 517 2. The transform ID for encryption, as a 16-bit big-endian word 518 519 3. The transform ID for integrity protection, as 16-bit in big- 520 endian word 521 522 4. NOTE: The following needs to be updated to take into account 523 progress of BTNS. 524 525 5. The initiator ID payload as used in the key exchange protocol 526 used for setting up the channel's SAs 527 528 6. The responder ID payload as used in the key exchange protocol 529 used for setting up the channel's SAs 530 531 7. Any additional application-provided data, encoded as the DER 532 encoding of an ASN.1 OCTET STRING 533 534 Note that traffic selectors are not included. Inclusion of 535 confidentiality/integrity algorithms protects against MITMs that can 536 compromise weaker algorithms that policy might permit, for the same 537 peers, for other traffic. 538 5396.1. GSS_Make_ipsec_channel_bindings() 540 541 Inputs: 542 543 544 o encr_alg INTEGER, 545 546 o integ_alg INTEGER, 547 548 o initiator_id OCTET_STRING, 549 550 o acceptor_id OCTET_STRING, 551 552 o additional_app_data OCTET STRING 553 554 Outputs: 555 556 557 558 559Williams Expires April 19, 2006 [Page 10] 560 561Internet-Draft GSS-API Channel Bindings October 2005 562 563 564 o major_status INTEGER, 565 566 o minor_status INTEGER, 567 568 o channel_bindings_app_data OCTET STRING 569 570 Return major_status codes: 571 572 o GSS_S_COMPLETE indicates no error. 573 574 o GSS_S_FAILURE indicates failure to construct the channel bindings 575 as a result, perhaps, of a memory management, or similar failure. 576 577 This function constructs an OCTET STRING for use as the value of the 578 application-data field of the GSS-CHANNEL-BINDINGS structure 579 described above. 580 5816.1.1. C-Bindings 582 583 OM_uint32 gss_make_ipsec_channel_bindings( 584 OM_uint32 *minor_status, 585 OM_uint32 encr_alg, 586 OM_uint32 integ_alg, 587 const gss_buffer_t initiator_id, 588 const gss_buffer_t acceptor_id, 589 const gss_buffer_t additional_app_data, 590 gss_buffer_t channel_bindings_app_data 591 ); 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615Williams Expires April 19, 2006 [Page 11] 616 617Internet-Draft GSS-API Channel Bindings October 2005 618 619 6207. Security Considerations 621 622 For general security considerations relating to channel bindings see 623 [CHANNEL-BINDINGS] 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671Williams Expires April 19, 2006 [Page 12] 672 673Internet-Draft GSS-API Channel Bindings October 2005 674 675 6768. References 677 6788.1. Normative 679 680 [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", 681 RFC 1964, June 1996. 682 683 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 684 Requirement Levels", BCP 14, RFC 2119, March 1997. 685 686 [RFC2743] Linn, J., "Generic Security Service Application Program 687 Interface Version 2, Update 1", RFC 2743, January 2000. 688 689 [RFC2744] Wray, J., "Generic Security Service API Version 2 : 690 C-bindings", RFC 2744, January 2000. 691 6928.2. Informative 693 694 [RFC0854] Postel, J. and J. Reynolds, "Telnet Protocol 695 Specification", STD 8, RFC 854, May 1983. 696 697 [RFC1035] Mockapetris, P., "Domain names - implementation and 698 specification", STD 13, RFC 1035, November 1987. 699 700 [RFC2025] Adams, C., "The Simple Public-Key GSS-API Mechanism 701 (SPKM)", RFC 2025, October 1996. 702 703 [RFC2203] Eisler, M., Chiu, A., and L. Ling, "RPCSEC_GSS Protocol 704 Specification", RFC 2203, September 1997. 705 706 [RFC2478] Baize, E. and D. Pinkas, "The Simple and Protected GSS-API 707 Negotiation Mechanism", RFC 2478, December 1998. 708 709 [RFC2623] Eisler, M., "NFS Version 2 and Version 3 Security Issues 710 and the NFS Protocol's Use of RPCSEC_GSS and Kerberos V5", 711 RFC 2623, June 1999. 712 713 [RFC3530] Shepler, S., Callaghan, B., Robinson, D., Thurlow, R., 714 Beame, C., Eisler, M., and D. Noveck, "Network File System 715 (NFS) version 4 Protocol", RFC 3530, April 2003. 716 717 718 719 720 721 722 723 724 725 726 727Williams Expires April 19, 2006 [Page 13] 728 729Internet-Draft GSS-API Channel Bindings October 2005 730 731 732Appendix A. Acknowledgments 733 734 The author would like to thank Mike Eisler for his work on the 735 Channel Conjunction Mechanism I-D and for bringing the problem to a 736 head, Sam Hartman for pointing out that channel bindings provide a 737 general solution to the channel binding problem, Jeff Altman for his 738 suggestion of using the TLS finished messages as the TLS channel 739 bindings, Bill Sommerfeld, for his help in developing channel 740 bindings for IPsec, and Radia Perlman for her most helpful comments. 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783Williams Expires April 19, 2006 [Page 14] 784 785Internet-Draft GSS-API Channel Bindings October 2005 786 787 788Author's Address 789 790 Nicolas Williams 791 Sun Microsystems 792 5300 Riata Trace Ct 793 Austin, TX 78727 794 US 795 796 Email: Nicolas.Williams@sun.com 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839Williams Expires April 19, 2006 [Page 15] 840 841Internet-Draft GSS-API Channel Bindings October 2005 842 843 844Intellectual Property Statement 845 846 The IETF takes no position regarding the validity or scope of any 847 Intellectual Property Rights or other rights that might be claimed to 848 pertain to the implementation or use of the technology described in 849 this document or the extent to which any license under such rights 850 might or might not be available; nor does it represent that it has 851 made any independent effort to identify any such rights. Information 852 on the procedures with respect to rights in RFC documents can be 853 found in BCP 78 and BCP 79. 854 855 Copies of IPR disclosures made to the IETF Secretariat and any 856 assurances of licenses to be made available, or the result of an 857 attempt made to obtain a general license or permission for the use of 858 such proprietary rights by implementers or users of this 859 specification can be obtained from the IETF on-line IPR repository at 860 http://www.ietf.org/ipr. 861 862 The IETF invites any interested party to bring to its attention any 863 copyrights, patents or patent applications, or other proprietary 864 rights that may cover technology that may be required to implement 865 this standard. Please address the information to the IETF at 866 ietf-ipr@ietf.org. 867 868 869Disclaimer of Validity 870 871 This document and the information contained herein are provided on an 872 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 873 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET 874 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, 875 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 876 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 877 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 878 879 880Copyright Statement 881 882 Copyright (C) The Internet Society (2005). This document is subject 883 to the rights, licenses and restrictions contained in BCP 78, and 884 except as set forth therein, the authors retain all their rights. 885 886 887Acknowledgment 888 889 Funding for the RFC Editor function is currently provided by the 890 Internet Society. 891 892 893 894 895Williams Expires April 19, 2006 [Page 16] 896 897 898