Network Working Group S. Josefsson
Internet-Draft January 9, 2007
Intended status: Standards Track
Expires: July 13, 2007
Using GSS-API Mechanisms in SASL: The GS2 Mechanism Family
draft-ietf-sasl-gs2-05
Status of this Memo
By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
This Internet-Draft will expire on July 13, 2007.
Copyright Notice
Copyright (C) The Internet Society (2007).
Josefsson Expires July 13, 2007 [Page 1]
Internet-Draft SASL GS2-* January 2007
Abstract
This document describes how to use a Generic Security Service
Application Program Interface (GSS-API) mechanism in the the Simple
Authentication and Security Layer (SASL) framework. This is done by
defining a new SASL mechanism family, called GS2. This mechanism
family offers a number of improvements over the previous SASL/GSS-API
mechanism: it is more general, uses fewer messages for the
authentication phase in some cases, and supports a SASL-specific
notion of channel binding.
See for more information.
Josefsson Expires July 13, 2007 [Page 2]
Internet-Draft SASL GS2-* January 2007
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Conventions used in this document . . . . . . . . . . . . . . 5
3. Mechanism name . . . . . . . . . . . . . . . . . . . . . . . . 6
3.1. Generating SASL mechanism names from GSS-API OIDs . . . . 6
3.2. Computing mechanism names manually . . . . . . . . . . . . 6
3.3. Examples . . . . . . . . . . . . . . . . . . . . . . . . . 6
4. SASL Authentication Exchange Message Format . . . . . . . . . 8
4.1. SASL Messages . . . . . . . . . . . . . . . . . . . . . . 8
4.2. Context Token Field . . . . . . . . . . . . . . . . . . . 9
4.2.1. Client side . . . . . . . . . . . . . . . . . . . . . 9
4.2.2. Server side . . . . . . . . . . . . . . . . . . . . . 10
4.3. Wrap Token Field . . . . . . . . . . . . . . . . . . . . . 11
4.3.1. The GS2_Wrap function . . . . . . . . . . . . . . . . 12
4.3.2. Client first GS2_Wrap input . . . . . . . . . . . . . 12
4.3.3. Server last GS2_Wrap input . . . . . . . . . . . . . . 13
4.3.4. Server first GS2_Wrap input . . . . . . . . . . . . . 13
4.3.5. Client last GS2_Wrap input . . . . . . . . . . . . . . 14
5. Channel Bindings . . . . . . . . . . . . . . . . . . . . . . . 15
6. Protocol Overview . . . . . . . . . . . . . . . . . . . . . . 16
7. Authentication Conditions . . . . . . . . . . . . . . . . . . 20
8. GSS-API Parameters . . . . . . . . . . . . . . . . . . . . . . 21
9. Security Layer Bits . . . . . . . . . . . . . . . . . . . . . 22
9.1. Examples . . . . . . . . . . . . . . . . . . . . . . . . . 22
10. Non-integrity capable GSS-API mechanisms . . . . . . . . . . . 24
11. Interoperability with the SASL "GSSAPI" mechanism . . . . . . 25
11.1. The interoperability problem . . . . . . . . . . . . . . . 25
11.2. Resolving the problem . . . . . . . . . . . . . . . . . . 25
11.3. Additional recommendations . . . . . . . . . . . . . . . . 25
12. Mechanisms that negotiate other mechanisms . . . . . . . . . . 26
12.1. The interoperability problem . . . . . . . . . . . . . . . 26
12.2. Security problem . . . . . . . . . . . . . . . . . . . . . 26
12.3. Resolving the problems . . . . . . . . . . . . . . . . . . 26
13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27
14. Security Considerations . . . . . . . . . . . . . . . . . . . 28
15. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 30
16. References . . . . . . . . . . . . . . . . . . . . . . . . . . 31
16.1. Normative References . . . . . . . . . . . . . . . . . . . 31
16.2. Informative References . . . . . . . . . . . . . . . . . . 31
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 33
Intellectual Property and Copyright Statements . . . . . . . . . . 34
Josefsson Expires July 13, 2007 [Page 3]
Internet-Draft SASL GS2-* January 2007
1. Introduction
Generic Security Service Application Program Interface (GSS-API) [3]
is a framework that provide security services to applications.
Simple Authentication and Security Layer (SASL) [2] is a framework to
provide authentication and security layers for connection based
protocols. This document describe how to use a GSS-API mechanism in
a connection-based protocol using the SASL framework.
All GSSAPI mechanisms are implicitly registered for use within SASL
by this specification. The SASL mechanism defined in this document
is known as the GS2 family.
The "Kerberos V5 GSS-API mechanism" [10] is also supported in SASL
through "SASL GSSAPI mechanisms" [12]. The difference between that
protocol and the one described here, is that this protocol offer more
features (i.e., channel bindings and round-trip optimizations) while
the other protocol is more widely deployed. There are
interoperability concerns by having the same GSS-API mechanism
available under more than one SASL mechanism name, see the section
"Interoperability with the GSSAPI mechanism" below.
There are interoperability and security concerns if this SASL
mechanism is used together with a GSS-API mechanism that negotiate
other GSS-API mechanisms (such as SPNEGO [11]), see the section
"Mechanisms that negotiate other mechanisms" below.
There are interoperability and security concerns with GSSAPI
mechanism that do not provide integrity, see the section "Non-
integrity capable GSS-API mechanisms" below.
SASL mechanism names starting with "GS2-" are reserved for SASL
mechanisms which conform to this document.
The IESG is considered to be the owner of all SASL mechanisms which
conform to this document. This does not necessarily imply that the
IESG is considered to be the owner of the underlying GSSAPI
mechanism.
Josefsson Expires July 13, 2007 [Page 4]
Internet-Draft SASL GS2-* January 2007
2. Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [1].
Josefsson Expires July 13, 2007 [Page 5]
Internet-Draft SASL GS2-* January 2007
3. Mechanism name
3.1. Generating SASL mechanism names from GSS-API OIDs
The SASL mechanism name for a GSS-API mechanism is the concatenation
of the string "GS2-" and the Base32 encoding [6] (with an upper case
alphabet) of the first ten bytes of the binary SHA-1 hash [4] string
computed over the ASN.1 DER encoding [8], including the tag and
length octets, of the GSS-API mechanism's Object Identifier. The
Base32 rules on padding characters and characters outside of the
base32 alphabet are not relevant to this use of Base32. If any
padding or non-alphabet characters are encountered, the name is not a
GS2 family mechanism name.
3.2. Computing mechanism names manually
The SASL mechanism name may be computed manually. This is useful
when the set of supported GSS-API mechanisms is known in advance. It
also obliterate the need to implement Base32, SHA-1 and DER in the
SASL mechanism. The computed mechanism name can be used directly in
the implementation, and the implementation need not concern itself
with that the mechanism is part of a mechanism family.
3.3. Examples
The OID for the SPKM-1 mechanism [13] is 1.3.6.1.5.5.1.1. The ASN.1
DER encoding of the OID, including the tag and length, is (in hex) 06
07 2b 06 01 05 05 01 01. The SHA-1 hash of the ASN.1 DER encoding is
(in hex) 1c f8 f4 2b 5a 9f 80 fa e9 f8 31 22 6d 5d 9d 56 27 86 61 ad.
Convert the first ten octets to binary, and re-group them in groups
of 5, and convert them back to decimal, which results in these
computations:
hex:
1c f8 f4 2b 5a 9f 80 fa e9 f8
binary:
00011100 11111000 11110100 00101011 01011010
10011111 10000000 11111010 11101001 11111000
binary in groups of 5:
00011 10011 11100 01111 01000 01010 11010 11010
10011 11110 00000 01111 10101 11010 01111 11000
decimal of each group:
3 19 28 15 8 10 26 26 19 30 0 15 21 26 15 24
Translating each decimal value using table 3 in Base32 [6] yields the
Josefsson Expires July 13, 2007 [Page 6]
Internet-Draft SASL GS2-* January 2007
character sequence DT4PIK22T6APV2PY. Thus the SASL mechanism name
for the SPKM-1 GSSAPI mechanism is "GS2-DT4PIK22T6APV2PY".
The OID for the Kerberos V5 GSS-API mechanism [10] is
1.2.840.113554.1.2.2 and its DER encoding is (in hex) 06 09 2A 86 48
86 F7 12 01 02 02. The SHA-1 hash is 82 d2 73 25 76 6b d6 c8 45 aa
93 25 51 6a fc ff 04 b0 43 60. Convert the first ten octets to
binary, and re-group them in groups of 5, and convert them back to
decimal, which results in these computations:
hex:
82 d2 73 25 76 6b d6 c8 45 aa
binary:
10000010 11010010 01110011 00100101 01110110
01101011 11010110 11001000 01000101 10101010
binary in groups of 5:
10000 01011 01001 00111 00110 01001 01011 10110
01101 01111 01011 01100 10000 10001 01101 01010
decimal of each group:
16 11 9 7 6 9 11 22 13 15 11 12 16 17 13 10
Translating each decimal value using table 3 in Base32 [6] yields the
character sequence QLJHGJLWNPLNQRNK. Thus the SASL mechanism name
for the Kerberos V5 GSSAPI mechanism is "GS2-QLJHGJLWNPLNQRNK".
Josefsson Expires July 13, 2007 [Page 7]
Internet-Draft SASL GS2-* January 2007
4. SASL Authentication Exchange Message Format
4.1. SASL Messages
During the SASL authentication exchange for GS2, a number of messages
following the following format is sent between the client and server.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Context length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Wrap token length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| /
/ [Context token] /
/ --------------------/
/ ---------------------/ /
/--------------------/ /
/ [Wrap token] /
/ /
/ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "Context length" and "Wrap token length" fields each contain a 4
octet (32 bit) integer encoded in network byte order, that indicate
the length of the "Context token" and "Wrap token" fields,
respectively. A length of 0 means that a particular field is not
present.
The "Context token" field, if present, contain a GSS-API context
establishment token generated by GSS_Init_sec_context or
GSS_Accept_sec_context.
The "Wrap token" field, if present, contain the output generated by
the GS2_Wrap function.
The fields need not be aligned to 32-bit a boundary. There is no
padding between fields.
Messages shorter than or equal to 8 octets are invalid. From that it
follows that at least one of the "Context token length" and the "Wrap
token length" integers MUST be non-zero in a particular message. If
the sum of the length integers is longer than the entire message
size, minus 8 octets for the length fields, the message is invalid.
During any successful authentication exchange, the client and server
will each send exactly one (non-empty) "Wrap token".
Josefsson Expires July 13, 2007 [Page 8]
Internet-Draft SASL GS2-* January 2007
Conforming implementations MUST NOT send additional data after the
above message syntax, and MUST ignore additional data. To
illustrate, implementations MUST NOT assume that the last "Wrap token
length" octets of the packet correspond to the "Wrap token", because
that would be incorrect if the packet contained additional data not
described by this document.
4.2. Context Token Field
The format of the "Context token" field inside the SASL token is
defined by each GSS-API mechanism, and the data is computed by (for
the client) GSS_Init_sec_context and (for the server)
GSS_Accept_sec_context.
4.2.1. Client side
The client calls GSS_Init_sec_context, passing in
input_context_handle of GSS_C_NO_CONTEXT (initially), mech_type of
the GSSAPI mechanism for which this SASL mechanism is registered, the
chan_binding is set to NULL, and targ_name equal to output_name from
GSS_Import_Name called with input_name_type of
GSS_C_NT_HOSTBASED_SERVICE (*) and input_name_string of
"service@hostname" where "service" is the service name specified in
the protocol's profile, and "hostname" is the fully qualified host
name of the server.
(*) - Clients MAY use name types other than
GSS_C_NT_HOSTBASED_SERVICE to import servers' acceptor names, but
only when they have a priori knowledge that the servers support
alternate name types. Otherwise clients MUST use
GSS_C_NT_HOSTBASED_SERVICE for importing acceptor names.
When calling the GSS_Init_sec_context the client SHOULD pass the
integ_req_flag of TRUE, but MAY set it to FALSE (see section 10
below). If the client intends to request a security layer, it MUST
also supply to the GSS_Init_sec_context a mutual_req_flag of TRUE,
and a sequence_req_flag of TRUE. If the client will be requesting a
security layer providing confidentiality protection, it MUST also
supply to the GSS_Init_sec_context a conf_req_flag of TRUE.
The client then responds with any resulting output_token.
If GSS_Init_sec_context returns GSS_S_CONTINUE_NEEDED, then the
client expect the server to issue a token in a subsequent challenge
or as additional information to the outcome of the authentication.
The client pass the context token to another call to
GSS_Init_sec_context, repeating the procedure, until GSS_S_COMPLETE
is returned or authentication is aborted.
Josefsson Expires July 13, 2007 [Page 9]
Internet-Draft SASL GS2-* January 2007
If the server sent a (non-empty) "Wrap token", the context token is
processed before processing the other tokens. This is required
because GSS_Unwrap may need the context to be in the state it is
after the "Context token" in the message has been processed.
When GSS_Init_sec_context returns GSS_S_COMPLETE, the client MUST
examine the context to ensure that it provides a level of protection
permitted by the client's security policy.
4.2.2. Server side
The server passes the first context token to GSS_Accept_sec_context
as input_token, setting input_context_handle to GSS_C_NO_CONTEXT
(initially), the chan_binding set to NULL, and a suitable
acceptor_cred_handle (see below).
Servers SHOULD use a credential obtained by calling GSS_Acquire_cred
or GSS_Add_cred for the GSS_C_NO_NAME desired_name and the OID of the
GSS-API mechanism for which this SASL mechanism is registered (*).
Servers MAY use GSS_C_NO_CREDENTIAL as an acceptor credential handle.
Servers MAY use a credential obtained by calling GSS_Acquire_cred or
GSS_Add_cred for the server's principal name(s) (**) and the GSS-API
mechanism for which this SASL mechanism is registered.
(*) - Unlike GSS_Add_cred the GSS_Acquire_cred uses an OID set of
GSS-API mechanism as an input parameter. The OID set can be created
by using GSS_Create_empty_OID_set and GSS_Add_OID_set_member. It can
be freed by calling the GSS_Release_oid_set.
(**) - Use of server's principal names having
GSS_C_NT_HOSTBASED_SERVICE name type and "service@hostname" format,
where "service" is the service name specified in the protocol's
profile, and "hostname" is the fully qualified host name of the
server, is RECOMMENDED. The server name can be generated by calling
GSS_Import_name with input_name_type of GSS_C_NT_HOSTBASED_SERVICE
and input_name_string of "service@hostname".
The server then responds with any resulting output_token.
The server pass any resulting challenge from the client to another
call to GSS_Accept_sec_context, repeating the procedure, until
GSS_S_COMPLETE is returned or authentication is aborted.
If the client sent a (non-empty) "Wrap token", the context token is
processed first.
Upon successful establishment of the security context (i.e.
GSS_Accept_sec_context returns GSS_S_COMPLETE) the server SHOULD
Josefsson Expires July 13, 2007 [Page 10]
Internet-Draft SASL GS2-* January 2007
verify that the negotiated GSS-API mechanism is indeed the registered
one. This is done by examining the value of the mech_type parameter
returned from the GSS_Accept_sec_context call. If the value differ,
the SASL authentication MUST be aborted.
Upon successful establishment of the security context and if the
server used GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL to create acceptor
credential handle, the server SHOULD also check using the
GSS_Inquire_context that the target_name used by the client matches:
- the GSS_C_NT_HOSTBASED_SERVICE "service@hostname" name syntax,
where "service" is the service name specified in the application
protocol's profile, and "hostname" is the fully qualified host name
of the server.
When GSS_Accept_sec_context returns GSS_S_COMPLETE, the server MUST
examine the context to ensure that it provides a level of protection
permitted by the server's security policy.
4.3. Wrap Token Field
The Wrap token field MUST NOT be sent or received before the
PROT_READY flag is set locally (by GSS_Init_sec_context or
Gss_Accept_sec_context), or if the PROT_READY flag is never set,
before the context has been fully established. The Wrap token field
does not have to be present directly when the PROT_READY flag is set.
During any exchange, exactly one Wrap token field is sent in each
direction. The GS2_Wrap function is defined below, and its inputs
MUST follow the format described below. If not exactly one Wrap
token is received by the client and by the server, the authentication
MUST fail.
If PROT_READY is never set by GSS_Init_sec_context or
GSS_Accept_sec_context, the flag is implied by successful context
negotiation. This is for GSS-API v1 mechanisms that do not support
PROT_READY, or for GSS-API mechanism that do not provide per-message
protection. This may result in a SASL token consisting of a context
token length of 0 and a Wrap token.
The entity that sends the first Wrap token will have to specify a
bitmap of supported and preferred quality of protection schemes. The
entity that replies to the Wrap tokens will pick a scheme, based on
the bitmask and local policy. The quality of protection values are
defined in section 9.
Two pairs of input formats to the GS2_Wrap function are defined. The
first pair is used when the client sends the Wrap token first and the
server responds. The other pair is used when the server sends the
Josefsson Expires July 13, 2007 [Page 11]
Internet-Draft SASL GS2-* January 2007
Wrap token first and the client responds.
The inputs below are passed to GS2_Wrap, and the output is used as
the Wrap token value.
Some fields in the input formats are optional, indicated by brackets
("[" and "]") and explained by the text below.
4.3.1. The GS2_Wrap function
The GS2_Wrap function have two implementations, and which one is used
depends on whether the negotiated GSS-API context supports per-
message protection. When a context is successfully negotiated (i.e.,
when GSS_S_COMPLETE is returned from, for clients,
GSS_Init_sec_context, or, for servers, GSS_Accept_sec_context) and
the output variable integ_avail is FALSE, then GSS_Wrap cannot be
used and instead we define GS2_Wrap to be the identity function.
When integ_avail is negotiated TRUE, the GS2_Wrap is identical to
calling the GSS_Wrap function with conf_flag set to FALSE and using
the generated output_message as the output data.
4.3.2. Client first GS2_Wrap input
The input to GS2_Wrap when the client sends a Wrap token field first
is as follows.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| client_qops | client_maxbuf |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| channel_binding_length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|[client_cbqops]| [channel_binding_data] /
/ /
/ / [authzid] /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "client_qops" integer indicate the client's preferred quality of
protection if channel bindings are absent or the negotiation of the
channel binding fails. The quality of protection values are defined
in section 9.
The "client_maxbuf" field indicate the maximum protected buffer size
the client can receive in network byte order. It MUST be 0 if the
client doesn't advertise support for any security layer, the server
MUST verify this. Small values can make it impossible for the server
to send any protected message to the client, due to the overhead
Josefsson Expires July 13, 2007 [Page 12]
Internet-Draft SASL GS2-* January 2007
added by GSS_Wrap, and the server MAY reject the authentication if it
detects this situation.
The "channel_binding_length" is a network byte order integer that
indicate the length of the "channel_binding_data" field.
The optional field "client_cbqops" is present only if
"channel_binding_length" is non-zero, and indicate the client's
preferred quality of protection if channel binding negotiation
succeeds. The quality of protection values are defined in section 9.
The optional field "channel_binding_data" is present only if
"channel_binding_length" is non-zero, and contain the actual channel
binding data.
The optional field "authzid" contain the authorization identity. The
authorization identity is encoded using UTF-8 [5]. The authorization
identity is not terminated with the NUL (U+0000) character. Servers
MUST validate that the authorization identity is valid UTF-8.
4.3.3. Server last GS2_Wrap input
The input to GS2_Wrap when the server sends a Wrap token field, after
receiving the Wrap token in the previous section from the client, is
as follows.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| server_qop | server_maxbuf |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "server_qop" field integer indicate the selected quality of
protection. The quality of protection values are defined in section
9.
The "server_maxbuf" field indicate the maximum protected data buffer
size the server can receive in network byte order. It MUST be 0 if
the server doesn't advertise support for any security layer, the
client MUST verify this. Small values can make it impossible for the
client to send any protected message to the server, due to the
overhead added by GSS_Wrap, and the client MAY reject the
authentication if it detects this situation.
4.3.4. Server first GS2_Wrap input
The input to GS2_Wrap when the server sends the Wrap token first is
as follows.
Josefsson Expires July 13, 2007 [Page 13]
Internet-Draft SASL GS2-* January 2007
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| server_qops | server_maxbuf |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|[server_cbqops]| [channel_binding_data] /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "server_qops" field is an integer indicating the server's
preferred quality of protection if channel bindings are absent or the
negotiation of the channel binding fails. The quality of protection
values are defined in section 9.
The "server_maxbuf" is the same as above.
The optional field "server_cbqops" indicate the server's preferred
quality of protection if channel binding negotiation succeeds. The
quality of protection values are defined in section 9.
The optional field "channel_binding_data" contain the actual channel
binding data.
4.3.5. Client last GS2_Wrap input
The input to GS2_Wrap when the clients sends a Wrap token field,
after receiving the Wrap token in the previous section from the
server, is as follows.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| client_qop | client_maxbuf |
/ [authzid] |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The "client_qop" field is the selected quality of protection. The
quality of protection values are defined in section 9.
The "client_maxbuf" and "authzid" fields are as above.
Josefsson Expires July 13, 2007 [Page 14]
Internet-Draft SASL GS2-* January 2007
5. Channel Bindings
The GS2 mechanism provide its own channel binding mechanism, instead
of using the "chan_binding" parameter in the GSS-API context
functions. The reason for this is that the GS2 mechanism provide an
option to proceed even if the channel bindings does not match. The
GSS-API framework specifies that authentication cannot proceed if
channel bindings do not match.
Client and servers MUST set the "chan_binding" parameter in the calls
to GSS_Init_sec_context and GSS_Accept_sec_context, respectively, to
NULL.
Implementations SHOULD set the "client_cbqops" and "server_cbqops" to
no security layer and instead depend on the session security afforded
by the bound-in channel.
Use of no SASL security layers in combination with channel binding
should provide better performance than using SASL security layers
over secure channels, and better security characteristics than using
no SASL security layers over secure channels without channel binding.
For more discussions of channel bindings, and the syntax of the
channel binding data for various security protocols, see [7].
Josefsson Expires July 13, 2007 [Page 15]
Internet-Draft SASL GS2-* January 2007
6. Protocol Overview
This section describe several high-level protocol exchanges. The
descriptions do not assume any properties of the actual GSS-API
mechanism. Protocol profiles, GSS-API mechanism specific behaviour,
and to some extent implementation and policy choices, will dictate
which packets are sent in what order. The protocol exchanges are
examples and other exchanges are permitted and will occur.
An informal pseudo-language is used to describe the packets sent
below. GS2_Wrap refer to the operation of calling GS2_Wrap on the
indicated fields, formatted in the structures described earlier.
GSS_Init_sec_context and GSS_Accept_sec_context refer to the context
token generated by calling the respective function. The GS2 SASL
Message is denoted as [Context_token, Wrap_token], and the length
fields are not mentioned.
An authentication exchange using GS2 may look like:
C: Request authentication exchange
S: Send ["", ""] token
C: Send [GSS_Init_sec_context, ""] token
...
S: After PROT_READY is set,
send [GSS_Accept_sec_context,
wrap_length, GS2_Wrap(server_qops | server_maxbuf]
...
C: After PROT_READY is set,
send [GSS_Init_sec_context,
wrap_length, GS2_Wrap (client_qop | client_maxbuf |
authzid)]
S: Send [GSS_Accept_sec_context, ""] token
C: Send [GSS_Init_sec_context, ""] token
...
S: Outcome of authentication exchange
Because GSS-API authentication is initiated by the client, the length
field will be 0 in the initial token from the server to the client
when the protocol profile does not support additional information to
be sent together with the authentication request.
The next example illustrate when the client sends its Wrap token
first.
Josefsson Expires July 13, 2007 [Page 16]
Internet-Draft SASL GS2-* January 2007
C: Request authentication exchange
S: Send ["", ""] token
C: Send [GSS_Init_sec_context, ""] token
...
C: After PROT_READY is set,
send [GSS_Init_sec_context,
GS2_Wrap(client_qops | client_maxbuf |
channel_binding_length=0 | authzid)]
...
S: After PROT_READY is set,
send [GSS_Accept_sec_context,
GS2_Wrap (server_qop | server_maxbuf)]
C: Send [GSS_Init_sec_context, ""] token
S: Send [GSS_Accept_sec_context, ""] token
...
S: Outcome of authentication exchange
If the protocol profile support the optional initial client response,
the first empty message can be optimized away, and then the protocol
exchange will look like:
C: Request authentication exchange and
send [GSS_Init_sec_context, ""] token
S: Send [GSS_Accept_sec_context, ""] token
...
S: Outcome of authentication exchange
If the protocol profile can also send additional information when
indicating the outcome of the authentication, then the protocol
exchange will look like:
C: Request authentication exchange and
send [GSS_Init_sec_context, ""] token
S: Send [GSS_Accept_sec_context, ""] token
...
C: Send [GSS_Init_sec_context, ""] token
S: Indicate successful authentication and
send [GSS_Accept_sec_context, ""] token
as additional information.
If the PROT_READY flag is never set by the GSS-API mechanism, the
GS2_Wrap message will be sent after the context has been established.
The protocol may look like:
Josefsson Expires July 13, 2007 [Page 17]
Internet-Draft SASL GS2-* January 2007
C: Request authentication exchange
...
S: GSS_Accept_sec_context() returns GSS_S_COMPLETE and outputs
a token, send ["", GS2_Wrap(server_qops | server_maxbuf)]
C: GSS_Init_sec_context() returns GSS_S_COMPLETE and does not
output a token, send
["", GS2_Wrap(client_qop | client_maxbuf |
channel_binding_length=0 | authzid)]
S: Outcome of authentication exchange
Alternatively, if the client finishes first, it may look like:
C: Request authentication exchange
...
C: GSS_Init_sec_context() returns GSS_S_COMPLETE and outputs a
token, send ["", GS2_Wrap(client_qops | client_maxbuf |
channel_binding_length=0 | authzid)]
S: GSS_Accept_sec_context() returns GSS_S_COMPLETE and does not
output a token, send ["", GS2_Wrap(server_qop | server_maxbuf |
channel_binding_length=0)]
S: Outcome of authentication exchange
Adding channel bindings to the last examples, gives the following
complex situation. Here the client request confidentiality for the
application data if channel binding fails but no SASL security layer
if channel binding negotiation succeeds:
C: Request authentication exchange
...
C: GSS_Init_sec_context() returns GSS_S_COMPLETE and outputs a
token, send [GSS_Init_sec_context,
GS2_Wrap(client_qops=0x04 | client_maxbuf |
channel_binding_length=n |
client_cbqops=0x01 | channel_binding_data |
authzid)]
S: GSS_Accept_sec_context() returns GSS_S_COMPLETE and does not
output a token, send ["",
GS2_Wrap(server_qop | server_maxbuf |
channel_binding_length=0)]
S: Outcome of authentication exchange
If the protocol support initial data from the client, and the
PROT_READY flag is set in the client after the first call to
GSS_Init_sec_context, and the server can send additional data to the
client when indicating successful authentication, the following
protocol exchange will occur.
Josefsson Expires July 13, 2007 [Page 18]
Internet-Draft SASL GS2-* January 2007
C: Request authentication exchange and
send [GSS_Init_sec_context,
GS2_Wrap (client_qops | client_maxbuf |
channel_binding_length=0 | authzid)] token
S: Indicate successful authentication and
send [GSS_Accept_sec_context,
GS2_Wrap(server_qop | server_maxbuf)] token
as additional information.
The last example illustrate the optimal (round-trip wise)
authentication possible using this protocol.
Josefsson Expires July 13, 2007 [Page 19]
Internet-Draft SASL GS2-* January 2007
7. Authentication Conditions
Authentication MUST NOT succeed if any one of the following
conditions are true:
o An invalid SASL token is received (i.e., length shorter than 4
octets).
o GSS_Init/Accept_sec_context() return anything other than
GSS_S_CONTINUE_NEEDED or GSS_S_COMPLETE.
o GSS_Wrap() returns anything other than GSS_S_COMPLETE.
o GSS_Unwrap() returns anything other than GSS_S_COMPLETE. (There
can't be supplementary status codes in GS2 at this point, so any
indications of out of order processing or replays is fatal.)
o The token returned from GSS_Unwrap fail to parse correctly (e.g.,
too short, invalid maximum buffer size) as the expected Wrap
token.
o Local policy reject the attempt. For example, client and server
can't agree on qop proposal.
o (server-side) Authorization of client principal (i.e., src_name in
GSS_Acecpt_sec_context) to requested authzid failed.
Josefsson Expires July 13, 2007 [Page 20]
Internet-Draft SASL GS2-* January 2007
8. GSS-API Parameters
The implementation MAY set any GSSAPI flags or arguments not
mentioned in this specification as is necessary for the
implementation to enforce its security policy.
Josefsson Expires July 13, 2007 [Page 21]
Internet-Draft SASL GS2-* January 2007
9. Security Layer Bits
The fields "client_qops", "server_qops", "client_cbqops", and
"server_cbqops" are bit-fields that encode a set of requested quality
of protection. The fields "client_qop" and "server_qop" encode a
single quality of protection value.
The "client_qop" and "server_qop" will contains the chosen security
layer.
Note that "client_qop" and "server_qop" MAY indicate a quality of
protection that was not offered by the server and client,
respectively. This SHOULD only be used when the server or client
(respectively) would otherwise fail the entire authentication
exchange. The server/client that receives a "client_qop"/
"server_qop" MUST verify that it corresponds to an acceptable
security level.
The security layers and their corresponding bit-masks are as follows:
1 No security layer
2 Integrity protection.
Sender calls GSS_Wrap with conf_flag set to FALSE
4 Confidentiality protection.
Sender calls GSS_Wrap with conf_flag set to TRUE
Other bit-masks may be defined in the future; bits which are not
understood MUST be negotiated off.
When decoding any received data with GSS_Unwrap the major_status
other than the GSS_S_COMPLETE MUST be treated as a fatal error.
For integrity and confidentiality protection, GS2 negotiates the
maximum size of the output_message to send. Implementations can use
the GSS_Wrap_size_limit call to determine the corresponding maximum
size input_message.
9.1. Examples
When no security layer is negotiated the octet will encode an integer
1 as follows.
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|0|1|
+-+-+-+-+-+-+-+-+
When integrity is negotiated the octet will encode an integer 2 as
Josefsson Expires July 13, 2007 [Page 22]
Internet-Draft SASL GS2-* January 2007
follows.
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|0|0|0|0|1|0|
+-+-+-+-+-+-+-+-+
When confidentiality is negotiated the octet will encode an integer 4
as follows.
0 1 2 3 4 5 6 7
+-+-+-+-+-+-+-+-+
|0|0|0|0|0|1|0|0|
+-+-+-+-+-+-+-+-+
Josefsson Expires July 13, 2007 [Page 23]
Internet-Draft SASL GS2-* January 2007
10. Non-integrity capable GSS-API mechanisms
Mechanisms that do not support integrity can be used with GS2, but
some security features cannot be provided, in particular including
channel bindings, security layers, and integrity protection of the
authorization identity.
Channel bindings and security layers MUST NOT be negotiated when the
GSS-API mechanism do not support integrity. It should also be
understood that the authorization identity is not integrity
protected.
Whether a mechanism supports integrity or not, for the purpose of
GS2, is decided by whether the integ_avail output variable from
GSS_Init_sec_context (for clients) and GSS_Accept_sec_context (for
servers). If integ_avail is FALSE, integrity is not supported.
There is a potential interoperability problem if a client call
GSS_Init_sec_context with integ_req_flag of TRUE and the context
negotiation fails because the mechanism (due to design, the
capability of the credentials, or policy) cannot provide per-message
protection. Calling GSS_Init_sec_context with a FALSE integ_req_flag
instead is not optimal, since a mechanism may then negotiate less
security than it would have otherwise done.
It is RECOMMENDED that implementations only ever call
GSS_Init_sec_context with a integ_req_flag of FALSE when it knows
that the particular GSS-API mechanism will not be able to negotiate
per-message protection services.
Implementations MAY have a policy to disallow non-integrity capable
mechanisms, and always call GSS_Init_sec_context with the
integ_req_flag set to TRUE.
Josefsson Expires July 13, 2007 [Page 24]
Internet-Draft SASL GS2-* January 2007
11. Interoperability with the SASL "GSSAPI" mechanism
The Kerberos V5 GSS-API [10] mechanism is currently used in SASL
under the name "GSSAPI", see GSSAPI mechanism [12]. The Kerberos V5
mechanism may also be used with the GS2 family. This causes an
interopability problem, which is discussed and resolved below.
11.1. The interoperability problem
If a client (or server) only support Kerberos V5 under the "GSSAPI"
name and the server (or client) only support Kerberos V5 under the
GS2 family, the authentication negotiation will fail.
11.2. Resolving the problem
If the Kerberos V5 mechanism is supported under GS2 in a server, the
server SHOULD also support Kerberos V5 through the "GSSAPI"
mechanism, to avoid interoperability problems with older clients.
Reasons for violating this recommendation may include security
considerations regarding the absent features in the GS2 mechanism.
The Kerberos V5 "GSSAPI" SASL mechanism lack channel bindings, which
could enable certain tunnel attacks [17].
11.3. Additional recommendations
It is RECOMMENDED to negotiate Kerberos V5 through the GS2 mechanism
rather than through the "GSSAPI" mechanism, if both are available,
because of the additional features in the GS2 mechanism.
Josefsson Expires July 13, 2007 [Page 25]
Internet-Draft SASL GS2-* January 2007
12. Mechanisms that negotiate other mechanisms
A GSS-API mechanism that negotiate other mechanisms interact badly
with the SASL mechanism negotiation. There are two problems. The
first is an interoperability problem and the second is a security
concern. The problems are described and resolved below.
12.1. The interoperability problem
If a client implement GSS-API mechanism X, potentially negotiated
through a GSS-API mechanism Y, and the server also implement GSS-API
mechanism X negotiated through a GSS-API mechanism Z, the
authentication negotiation will fail.
12.2. Security problem
If a client's policy is to first prefer GSSAPI mechanism X, then non-
GSSAPI mechanism Y, then GSSAPI mechanism Z, and if a server supports
mechanisms Y and Z but not X, then if the client attempts to
negotiate mechanism X by using a GSS-API mechanism that negotiate
other mechanisms (such as SPNEGO), it may end up using mechanism Z
when it ideally should have used mechanism Y. For this reason, the
use of GSS-API mechanisms that negotiate other mechanisms are
disallowed under GS2.
12.3. Resolving the problems
GSS-API mechanisms that negotiate other mechanisms MUST NOT be used
with the GS2 SASL mechanism. This specifically exclude negotiating
SPNEGO [11] under GS2.
The GSS_C_MA_MECH_NEGO attribute of GSS_Inquire_attrs_for_mech() [16]
can be used to identify such mechanisms.
Josefsson Expires July 13, 2007 [Page 26]
Internet-Draft SASL GS2-* January 2007
13. IANA Considerations
The IANA is advised that SASL mechanism names starting with "GS2-"
are reserved for SASL mechanisms which conform to this document. The
IANA is directed to place a statement to that effect in the sasl-
mechanisms registry.
Subject: Registration of SASL mechanism GS2-*
SASL mechanism prefix: GS2-
Security considerations: RFC [THIS-DOC]
Published specification: RFC [THIS-DOC]
Person & email address to contact for further information:
Simon Josefsson
Intended usage: COMMON
Owner/Change controller: iesg@ietf.org
Note: Compare with the GSSAPI and GSS-SPNEGO mechanisms.
Josefsson Expires July 13, 2007 [Page 27]
Internet-Draft SASL GS2-* January 2007
14. Security Considerations
Security issues are discussed throughout this memo.
The security provided by GS2 depends on the security provided by the
GSS-API mechanism. If the mechanism do not provide integrity
protection, the authorization identity can be replaced by a man in
the middle, and channel bindings and security layers cannot be
negotiated. Therefor, it is generally recommended against using any
GSS-API mechanism widely on the Internet that do not support
integrity.
Because the negotiation of a GSS-API mechanism may be done in the
clear, it is important for the GSS-API mechanisms to be designed such
that an active attacker cannot obtain an authentication with weaker
security properties by modifying the challenges and responses.
When a server or client supports multiple GSS-API mechanisms, each of
which has a different security strength, it is possible for an active
attacker to cause a party to use the least secure mechanism
supported. There are several ways to mitigate this problem:
1. Integrity protected transports can be used, e.g., TLS [14]. To
protect against certain tunnel attacks [17] with that solution,
the GSS-API mechanisms has to support integrity to provide
support for channel bindings
2. A client or server which supports mechanisms of different
strengths should have a configurable minimum strength that it
will use. It is not sufficient for this minimum strength check
to only be on the server, since an active attacker can change
which mechanisms the client sees as being supported, causing the
client to send authentication credentials for its weakest
supported mechanism.
3. Specify how to use the SPNEGO mechanism in SASL.
The channel binding is sent without privacy protection and knowledge
of it is assumed to provide no advantage to an attacker. This is a
property that has to be considered when specifying channel bindings
for a security protocol that will be used with GS2.
When constructing the input_name_string, the client should not
canonicalize the server's fully qualified domain name using an
insecure or untrusted directory service, such as the Domain Name
System [9] without DNSSEC [15].
Josefsson Expires July 13, 2007 [Page 28]
Internet-Draft SASL GS2-* January 2007
GS2 hard code the use of the SHA-1 algorithm to compute the mechanism
names, and it is not possible to negotiate the use of other hash
algorithms. However, no traditional cryptographic hash properties
(such as collision resistance or pre-image resistance) are required
nor assumed. The required and assumed property is that it is
statistically unlikely that two different DER-encoded OID's share the
same first 10 octets of the SHA-1 value.
Additional security considerations are in the SASL and GSSAPI
specifications. Additional security considerations for the Kerberos
V5 GSSAPI mechanism can be found in [10]. We stress that service
names should not be canonicalized using an unsecured directory
service such as the DNS without DNSSEC.
Josefsson Expires July 13, 2007 [Page 29]
Internet-Draft SASL GS2-* January 2007
15. Acknowledgements
This document is a revision of RFC 2222. This version was derived
from draft-ietf-sasl-gssapi-02 which was prepared by Alexey Melnikov
with significant contributions from John G. Myers, although the
majority of this document has been rewritten by the current author.
Contributions of many members of the SASL mailing list are gratefully
acknowledged. In particular, ideas and feedback from Sam Hartman,
Jeffrey Hutzelman, Alexey Melnikov, Nicolas Williams, and Tom Yu
improved the document and the protocol.
Josefsson Expires July 13, 2007 [Page 30]
Internet-Draft SASL GS2-* January 2007
16. References
16.1. Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Melnikov, A. and K. Zeilenga, "Simple Authentication and
Security Layer (SASL)", RFC 4422, June 2006.
[3] Linn, J., "Generic Security Service Application Program
Interface Version 2, Update 1", RFC 2743, January 2000.
[4] Eastlake, D. and P. Jones, "US Secure Hash Algorithm 1 (SHA1)",
RFC 3174, September 2001.
[5] Yergeau, F., "UTF-8, a transformation format of ISO 10646",
STD 63, RFC 3629, November 2003.
[6] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings",
RFC 4648, October 2006.
[7] Williams, N., "On the Use of Channel Bindings to Secure
Channels", draft-ietf-nfsv4-channel-bindings-04 (work in
progress), June 2006.
[8] International Organization for Standardization, "Information
Processing Systems - Open Systems Interconnection -
Specification of Abstract Syntax Notation One (ASN.1)",
ISO Standard 8824, December 1990.
16.2. Informative References
[9] Mockapetris, P., "Domain names - concepts and facilities",
STD 13, RFC 1034, November 1987.
[10] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC 1964,
June 1996.
[11] Baize, E. and D. Pinkas, "The Simple and Protected GSS-API
Negotiation Mechanism", RFC 2478, December 1998.
[12] Melnikov, A., "The Kerberos V5 ("GSSAPI") Simple Authentication
and Security Layer (SASL) Mechanism", RFC 4752, November 2006.
[13] Adams, C., "The Simple Public-Key GSS-API Mechanism (SPKM)",
RFC 2025, October 1996.
Josefsson Expires July 13, 2007 [Page 31]
Internet-Draft SASL GS2-* January 2007
[14] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS)
Protocol Version 1.1", RFC 4346, April 2006.
[15] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
"DNS Security Introduction and Requirements", RFC 4033,
March 2005.
[16] Williams, N., "Extended Generic Security Service Mechanism
Inquiry APIs", draft-ietf-kitten-extended-mech-inquiry-01 (work
in progress), October 2005.
[17] Asokan, N., Niemi, V., and K. Nyberg, "Man-in-the-Middle in
Tunneled Authentication",
WWW http://www.saunalahti.fi/~asokan/research/mitm.html.
Josefsson Expires July 13, 2007 [Page 32]
Internet-Draft SASL GS2-* January 2007
Author's Address
Simon Josefsson
Email: simon@josefsson.org
Josefsson Expires July 13, 2007 [Page 33]
Internet-Draft SASL GS2-* January 2007
Full Copyright Statement
Copyright (C) The Internet Society (2007).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgment
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
Josefsson Expires July 13, 2007 [Page 34]