Skip to main content

4. Encryption and Checksum Specifications

Overview​

This section specifies the encryption and checksum mechanisms used in the Kerberos protocol. Kerberos V5 is designed to support multiple encryption and checksum algorithms, allowing for cryptographic agility.

Key Concepts​

Encryption Types​

Kerberos uses various encryption algorithms identified by encryption type (etype) numbers. Each encryption type specifies:

  • The encryption algorithm
  • Key generation method
  • Cipher modes and parameters

Checksum Types​

Checksum (integrity) mechanisms are identified by checksum type numbers. Checksums provide:

  • Integrity protection
  • Detection of tampering
  • Authentication (when keyed)

Cryptographic Requirements​

General Principles​

  • All encryption must use well-defined, registered algorithms
  • Keys must be properly generated and managed
  • Random values must use cryptographically strong random number generators
  • Implementations should support cryptographic agility

Algorithm Profiles​

Each encryption algorithm used with Kerberos must specify:

  • Encryption and decryption procedures
  • Key generation from passwords or random data
  • Cryptographic checksum computation
  • Message integrity code (MIC) computation
  • Pseudo-random function (PRF) for key derivation

Mandatory Implementations​

Certain encryption types are required for interoperability. See Section 8 for specific requirements.

Key Usage Numbers​

Different uses of keys in the protocol are identified by key usage numbers to ensure that keys used for one purpose cannot be reused for another purpose, preventing cross-protocol attacks.

Cryptographic Profiles​

Detailed cryptographic profiles are defined in separate documents (RFC 3961, RFC 3962, RFC 4757, etc.) and are incorporated by reference.

Reference​

For complete technical details and algorithm specifications, refer to:

Last updated on