Appendix A. ASN.1 Module (ASN.1-Modul)

Dieser Anhang enthält das vollständige ASN.1-Modul, das alle Kerberos-Protokollnachrichten und Datenstrukturen definiert. Das Modul verwendet Abstract Syntax Notation One (ASN.1, abstrakte Syntaxnotation eins) und Distinguished Encoding Rules (DER, unterscheidbare Kodierungsregeln).

Moduldefinition

KerberosV5Spec2 {
        iso(1) identified-organization(3) dod(6) internet(1)
        security(5) kerberosV5(2) modules(4) krb5spec2(2)
} DEFINITIONS EXPLICIT TAGS ::= BEGIN

Definitionen grundlegender Typen

Zeichenketten- und Ganzzahltypen

-- Basistypen
KerberosString  ::= GeneralString (IA5String)
Realm           ::= KerberosString
PrincipalName   ::= SEQUENCE {
        name-type       [0] Int32,
        name-string     [1] SEQUENCE OF KerberosString
}

-- Zeittypen
KerberosTime    ::= GeneralizedTime

-- Ganzzahltypen
Int32           ::= INTEGER (-2147483648..2147483647)
UInt32          ::= INTEGER (0..4294967295)
Microseconds    ::= INTEGER (0..999999)

Netzwerkadresstypen

HostAddress     ::= SEQUENCE  {
        addr-type       [0] Int32,
        address         [1] OCTET STRING
}

HostAddresses   ::= SEQUENCE OF HostAddress

Autorisierungsdatentypen

AuthorizationData       ::= SEQUENCE OF SEQUENCE {
        ad-type         [0] Int32,
        ad-data         [1] OCTET STRING
}

Pre-Authentifizierungsdatentypen

PA-DATA         ::= SEQUENCE {
        padata-type     [1] Int32,
        padata-value    [2] OCTET STRING
}

Flags und Verschlüsselungstypen

KerberosFlags   ::= BIT STRING (SIZE (32..MAX))

EncryptedData   ::= SEQUENCE {
        etype   [0] Int32,
        kvno    [1] UInt32 OPTIONAL,
        cipher  [2] OCTET STRING
}

EncryptionKey   ::= SEQUENCE {
        keytype         [0] Int32,
        keyvalue        [1] OCTET STRING
}

Checksum        ::= SEQUENCE {
        cksumtype       [0] Int32,
        checksum        [1] OCTET STRING
}

Ticket-Strukturen

Ticket          ::= [APPLICATION 1] SEQUENCE {
        tkt-vno         [0] INTEGER (5),
        realm           [1] Realm,
        sname           [2] PrincipalName,
        enc-part        [3] EncryptedData
}

EncTicketPart   ::= [APPLICATION 3] SEQUENCE {
        flags                   [0] TicketFlags,
        key                     [1] EncryptionKey,
        crealm                  [2] Realm,
        cname                   [3] PrincipalName,
        transited               [4] TransitedEncoding,
        authtime                [5] KerberosTime,
        starttime               [6] KerberosTime OPTIONAL,
        endtime                 [7] KerberosTime,
        renew-till              [8] KerberosTime OPTIONAL,
        caddr                   [9] HostAddresses OPTIONAL,
        authorization-data      [10] AuthorizationData OPTIONAL
}

TransitedEncoding       ::= SEQUENCE {
        tr-type         [0] Int32,
        contents        [1] OCTET STRING
}

TicketFlags     ::= KerberosFlags

KDC-Anfragen und -Antworten

AS-REQ          ::= [APPLICATION 10] KDC-REQ
TGS-REQ         ::= [APPLICATION 12] KDC-REQ

KDC-REQ         ::= SEQUENCE {
        pvno            [1] INTEGER (5),
        msg-type        [2] INTEGER (10 | 12),
        padata          [3] SEQUENCE OF PA-DATA OPTIONAL,
        req-body        [4] KDC-REQ-BODY
}

KDC-REQ-BODY    ::= SEQUENCE {
        kdc-options             [0] KDCOptions,
        cname                   [1] PrincipalName OPTIONAL,
        realm                   [2] Realm,
        sname                   [3] PrincipalName OPTIONAL,
        from                    [4] KerberosTime OPTIONAL,
        till                    [5] KerberosTime,
        rtime                   [6] KerberosTime OPTIONAL,
        nonce                   [7] UInt32,
        etype                   [8] SEQUENCE OF Int32,
        addresses               [9] HostAddresses OPTIONAL,
        enc-authorization-data  [10] EncryptedData OPTIONAL,
        additional-tickets      [11] SEQUENCE OF Ticket OPTIONAL
}

KDCOptions      ::= KerberosFlags

AS-REP          ::= [APPLICATION 11] KDC-REP
TGS-REP         ::= [APPLICATION 13] KDC-REP

KDC-REP         ::= SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (11 | 13),
        padata          [2] SEQUENCE OF PA-DATA OPTIONAL,
        crealm          [3] Realm,
        cname           [4] PrincipalName,
        ticket          [5] Ticket,
        enc-part        [6] EncryptedData
}

EncASRepPart    ::= [APPLICATION 25] EncKDCRepPart
EncTGSRepPart   ::= [APPLICATION 26] EncKDCRepPart

EncKDCRepPart   ::= SEQUENCE {
        key             [0] EncryptionKey,
        last-req        [1] LastReq,
        nonce           [2] UInt32,
        key-expiration  [3] KerberosTime OPTIONAL,
        flags           [4] TicketFlags,
        authtime        [5] KerberosTime,
        starttime       [6] KerberosTime OPTIONAL,
        endtime         [7] KerberosTime,
        renew-till      [8] KerberosTime OPTIONAL,
        srealm          [9] Realm,
        sname           [10] PrincipalName,
        caddr           [11] HostAddresses OPTIONAL
}

LastReq         ::= SEQUENCE OF SEQUENCE {
        lr-type         [0] Int32,
        lr-value        [1] KerberosTime
}

Anwendungsanfragen und -antworten

AP-REQ          ::= [APPLICATION 14] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (14),
        ap-options      [2] APOptions,
        ticket          [3] Ticket,
        authenticator   [4] EncryptedData
}

APOptions       ::= KerberosFlags

Authenticator   ::= [APPLICATION 2] SEQUENCE  {
        authenticator-vno       [0] INTEGER (5),
        crealm                  [1] Realm,
        cname                   [2] PrincipalName,
        cksum                   [3] Checksum OPTIONAL,
        cusec                   [4] Microseconds,
        ctime                   [5] KerberosTime,
        subkey                  [6] EncryptionKey OPTIONAL,
        seq-number              [7] UInt32 OPTIONAL,
        authorization-data      [8] AuthorizationData OPTIONAL
}

AP-REP          ::= [APPLICATION 15] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (15),
        enc-part        [2] EncryptedData
}

EncAPRepPart    ::= [APPLICATION 27] SEQUENCE {
        ctime           [0] KerberosTime,
        cusec           [1] Microseconds,
        subkey          [2] EncryptionKey OPTIONAL,
        seq-number      [3] UInt32 OPTIONAL
}

Sicherheitsnachrichtentypen

KRB-SAFE        ::= [APPLICATION 20] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (20),
        safe-body       [2] KRB-SAFE-BODY,
        cksum           [3] Checksum
}

KRB-SAFE-BODY   ::= SEQUENCE {
        user-data       [0] OCTET STRING,
        timestamp       [1] KerberosTime OPTIONAL,
        usec            [2] Microseconds OPTIONAL,
        seq-number      [3] UInt32 OPTIONAL,
        s-address       [4] HostAddress,
        r-address       [5] HostAddress OPTIONAL
}

KRB-PRIV        ::= [APPLICATION 21] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (21),
        enc-part        [3] EncryptedData
}

EncKrbPrivPart  ::= [APPLICATION 28] SEQUENCE {
        user-data       [0] OCTET STRING,
        timestamp       [1] KerberosTime OPTIONAL,
        usec            [2] Microseconds OPTIONAL,
        seq-number      [3] UInt32 OPTIONAL,
        s-address       [4] HostAddress,
        r-address       [5] HostAddress OPTIONAL
}

KRB-CRED        ::= [APPLICATION 22] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (22),
        tickets         [2] SEQUENCE OF Ticket,
        enc-part        [3] EncryptedData
}

EncKrbCredPart  ::= [APPLICATION 29] SEQUENCE {
        ticket-info     [0] SEQUENCE OF KrbCredInfo,
        nonce           [1] UInt32 OPTIONAL,
        timestamp       [2] KerberosTime OPTIONAL,
        usec            [3] Microseconds OPTIONAL,
        s-address       [4] HostAddress OPTIONAL,
        r-address       [5] HostAddress OPTIONAL
}

KrbCredInfo     ::= SEQUENCE {
        key             [0] EncryptionKey,
        prealm          [1] Realm OPTIONAL,
        pname           [2] PrincipalName OPTIONAL,
        flags           [3] TicketFlags OPTIONAL,
        authtime        [4] KerberosTime OPTIONAL,
        starttime       [5] KerberosTime OPTIONAL,
        endtime         [6] KerberosTime OPTIONAL,
        renew-till      [7] KerberosTime OPTIONAL,
        srealm          [8] Realm OPTIONAL,
        sname           [9] PrincipalName OPTIONAL,
        caddr           [10] HostAddresses OPTIONAL
}

Fehlernachrichten

KRB-ERROR       ::= [APPLICATION 30] SEQUENCE {
        pvno            [0] INTEGER (5),
        msg-type        [1] INTEGER (30),
        ctime           [2] KerberosTime OPTIONAL,
        cusec           [3] Microseconds OPTIONAL,
        stime           [4] KerberosTime,
        susec           [5] Microseconds,
        error-code      [6] Int32,
        crealm          [7] Realm OPTIONAL,
        cname           [8] PrincipalName OPTIONAL,
        realm           [9] Realm,
        sname           [10] PrincipalName,
        e-text          [11] KerberosString OPTIONAL,
        e-data          [12] OCTET STRING OPTIONAL
}

Pre-Authentifizierung und Methodendaten

METHOD-DATA     ::= SEQUENCE OF PA-DATA

TYPED-DATA      ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
        data-type       [0] Int32,
        data-value      [1] OCTET STRING OPTIONAL
}

PA-ENC-TIMESTAMP        ::= EncryptedData

PA-ENC-TS-ENC           ::= SEQUENCE {
        patimestamp     [0] KerberosTime,
        pausec          [1] Microseconds OPTIONAL
}

ETYPE-INFO-ENTRY        ::= SEQUENCE {
        etype           [0] Int32,
        salt            [1] OCTET STRING OPTIONAL
}

ETYPE-INFO              ::= SEQUENCE OF ETYPE-INFO-ENTRY

ETYPE-INFO2-ENTRY       ::= SEQUENCE {
        etype           [0] Int32,
        salt            [1] KerberosString OPTIONAL,
        s2kparams       [2] OCTET STRING OPTIONAL
}

ETYPE-INFO2             ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY

Autorisierungsdatenelemente

AD-IF-RELEVANT          ::= AuthorizationData

AD-KDCIssued            ::= SEQUENCE {
        ad-checksum     [0] Checksum,
        i-realm         [1] Realm OPTIONAL,
        i-sname         [2] PrincipalName OPTIONAL,
        elements        [3] AuthorizationData
}

AD-AND-OR               ::= SEQUENCE {
        condition-count [0] Int32,
        elements        [1] AuthorizationData
}

AD-MANDATORY-FOR-KDC    ::= AuthorizationData

END

Hinweise zur Verwendung

Implementierer SOLLTEN:

DER-Kodierungsregeln strikt einhalten – alle Nachrichten mit Distinguished Encoding Rules kodieren
Nachrichtenstruktur validieren – sicherstellen, dass alle erforderlichen Felder vorhanden und korrekt formatiert sind
Optionale Felder behandeln – Felder mit OPTIONAL korrekt verarbeiten
Interoperabilität testen – Kompatibilitätstests mit anderen Implementierungen durchführen
Tags beachten – APPLICATION-Tags kennzeichnen oberste Nachrichtentypen
Einschränkungen verstehen – SIZE- und INTEGER-Bereichseinschränkungen beachten

Kodierungshinweise

KerberosFlags: Mindestens 32 Bits senden, auch wenn nicht alle Bits genutzt werden
KerberosString: Auf den Zeichensatz von IA5String beschränkt
KerberosTime: Verwendet GeneralizedTime im Format YYYYMMDDHHMMSSz
Optionale Sequenzen: Eine leere OPTIONAL SEQUENCE OF sollte weggelassen werden, nicht als leer gesendet
Ganzzahltypen: Int32 und UInt32 sind auf 32-Bit-Bereiche beschränkt, um Interoperabilität zu gewährleisten

Reference (Referenz)

Die vollständige ASN.1-Moduldefinition findet sich in RFC 4120 Anhang A.

Moduldefinition​

Definitionen grundlegender Typen​

Zeichenketten- und Ganzzahltypen​

Netzwerkadresstypen​

Autorisierungsdatentypen​

Pre-Authentifizierungsdatentypen​

Flags und Verschlüsselungstypen​

Ticket-Strukturen​

KDC-Anfragen und -Antworten​

Anwendungsanfragen und -antworten​

Sicherheitsnachrichtentypen​

Fehlernachrichten​

Pre-Authentifizierung und Methodendaten​

Autorisierungsdatenelemente​

Hinweise zur Verwendung​

Kodierungshinweise​

Reference (Referenz)​