Kerberos Parameters

Created

  • 2004-06-29

Last Updated

  • 2024-12-06

Available Formats

Kerberos Encryption Type Numbers

Registration Procedure(s)

  • Standards Action for standards-track RFCs; non-standards-track RFCs must be reviewed by an expert.

Expert(s)

  • Ken Raeburn

Reference

  • RFC 3961: Encryption and Checksum Specifications for Kerberos 5

Note

These are signed values ranging from -2147483648 to 2147483647. Positive values should be assigned only for algorithms specified in accordance with this specification for use with Kerberos or related protocols. Negative values are for private use; local and experimental algorithms should use these values. Zero is reserved and may not be assigned.

Available Formats

etype encryption type Reference
0 reserved RFC 6448
1 des-cbc-crc (deprecated) RFC 6649
2 des-cbc-md4 (deprecated) RFC 6649
3 des-cbc-md5 (deprecated) RFC 6649
4 Reserved RFC 3961
5 des3-cbc-md5 (deprecated) RFC 8429
6 Reserved RFC 3961
7 des3-cbc-sha1 (deprecated) RFC 8429
8 Unassigned
9 dsaWithSHA1-CmsOID RFC 4556
10 md5WithRSAEncryption-CmsOID RFC 4556
11 sha1WithRSAEncryption-CmsOID RFC 4556
12 rc2CBC-EnvOID RFC 4556
13 rsaEncryption-EnvOID RFC 4556; from PKCS#1 v1.5]
14 rsaES-OAEP-ENV-OID RFC 4556; from PKCS#1 v2.0]
15 des-ede3-cbc-Env-OID RFC 4556
16 des3-cbc-sha1-kd (deprecated) RFC 8429
17 aes128-cts-hmac-sha1-96 RFC 3962
18 aes256-cts-hmac-sha1-96 RFC 3962
19 aes128-cts-hmac-sha256-128 RFC 8009
20 aes256-cts-hmac-sha384-192 RFC 8009
21-22 Unassigned
23 rc4-hmac (deprecated) RFC 8429
24 rc4-hmac-exp (deprecated) RFC 6649
25 camellia128-cts-cmac RFC 6803
26 camellia256-cts-cmac RFC 6803
27-64 Unassigned
65 subkey-keymaterial (opaque; PacketCable)
66-2147483647 Unassigned

Kerberos Checksum Type Numbers

Registration Procedure(s)

  • Standards Action for standards-track RFCs; non-standards-track RFCs must be reviewed by an expert.

Expert(s)

  • Ken Raeburn

Reference

  • RFC 3961: Encryption and Checksum Specifications for Kerberos 5

Note

These are signed values ranging from -2147483648 to 2147483647. Positive values should be assigned only for algorithms specified in accordance with this specification for use with Kerberos or related protocols. Negative values are for private use; local and experimental algorithms should use these values. Zero is reserved and may not be assigned.

Available Formats

sumtype value Checksum type checksum size Reference
0 Reserved RFC 3961
1 CRC32 (deprecated) 4 RFC 6649
2 rsa-md4 (deprecated) 16 RFC 6649
3 rsa-md4-des (deprecated) 24 RFC 6649
4 des-mac (deprecated) 16 RFC 6649
5 des-mac-k (deprecated) 8 RFC 6649
6 rsa-md4-des-k (deprecated) 16 RFC 6649
7 rsa-md5 (deprecated) 16 RFC 8429
8 rsa-md5-des (deprecated) 24 RFC 6649
9 rsa-md5-des3 24
10 sha1 (unkeyed) 20
11 Unassigned
12 hmac-sha1-des3-kd (deprecated) 20 RFC 8429
13 hmac-sha1-des3 (deprecated) 20 RFC 8429
14 sha1 (unkeyed) 20
15 hmac-sha1-96-aes128 20 RFC 3962
16 hmac-sha1-96-aes256 20 RFC 3962
17 cmac-camellia128 16 RFC 6803
18 cmac-camellia256 16 RFC 6803
19 hmac-sha256-128-aes128 16 RFC 8009
20 hmac-sha384-192-aes256 24 RFC 8009
21-32770 Unassigned
32771 Reserved RFC 1964
32772-2147483647 Unassigned

Kerberos TCP Extensions

Reference

  • RFC 5021: Extended Kerberos Version 5 Key Distribution Center (KDC) Exchanges over TCP

Available Formats

Range Registration Procedures Note
0-29 Standards Action or IESG Approval
30 Reserved Standards Action that updates or obsoletes RFC 5021
Value Description Reference
0 Krb5 over TLS RFC 6251
1-29 Unassigned
30 Reserved RFC 5021

Pre-authentication and Typed Data

Registration Procedure(s)

  • Expert Review

Expert(s)

  • Sam Hartman (primary), Larry Zhu (secondary)

Reference

  • RFC 6113: A Generalized Framework for Kerberos Pre-Authentication

Note

The designated expert may find that IETF Review is required. See RFC 6113 for more information.

Available Formats

Type Value Reference
1 PA-TGS-REQ RFC 4120
2 PA-ENC-TIMESTAMP RFC 4120
3 PA-PW-SALT RFC 4120
4 reserved RFC 6113
5 PA-ENC-UNIX-TIME (deprecated) RFC 4120
6 PA-SANDIA-SECUREID RFC 4120
7 PA-SESAME RFC 4120
8 PA-OSF-DCE RFC 4120
9 PA-CYBERSAFE-SECUREID RFC 4120
10 PA-AFS3-SALT RFC 4120; RFC 3961
11 PA-ETYPE-INFO RFC 4120
12 PA-SAM-CHALLENGE draft-ietf-cat-kerberos-passwords-04
13 PA-SAM-RESPONSE draft-ietf-cat-kerberos-passwords-04
14 PA-PK-AS-REQ_OLD draft-ietf-cat-kerberos-pk-init-09
15 PA-PK-AS-REP_OLD draft-ietf-cat-kerberos-pk-init-09
16 PA-PK-AS-REQ RFC 4556
17 PA-PK-AS-REP RFC 4556
18 PA-PK-OCSP-RESPONSE RFC 4557
19 PA-ETYPE-INFO2 RFC 4120
20 PA-USE-SPECIFIED-KVNO RFC 4120
20 PA-SVR-REFERRAL-INFO RFC 6806
21 PA-SAM-REDIRECT draft-ietf-krb-wg-kerberos-sam-03
22 PA-GET-FROM-TYPED-DATA (embedded in typed data); RFC 4120
22 TD-PADATA (embeds padata); RFC 4120
23 PA-SAM-ETYPE-INFO (sam/otp); draft-ietf-krb-wg-kerberos-sam-03
24 PA-ALT-PRINC draft-ietf-krb-wg-hw-auth-04
25 PA-SERVER-REFERRAL draft-ietf-krb-wg-kerberos-referrals-11
26-29 Unassigned
30 PA-SAM-CHALLENGE2 draft-ietf-krb-wg-kerberos-sam-03
31 PA-SAM-RESPONSE2 draft-ietf-krb-wg-kerberos-sam-03
32-40 Unassigned
41 PA-EXTRA-TGT Reserved extra TGT; RFC 6113
42-100 Unassigned
101 TD-PKINIT-CMS-CERTIFICATES RFC 4556
102 TD-KRB-PRINCIPAL PrincipalName; RFC 6113
103 TD-KRB-REALM Realm; RFC 6113
104 TD-TRUSTED-CERTIFIERS RFC 4556
105 TD-CERTIFICATE-INDEX RFC 4556
106 TD-APP-DEFINED-ERROR Application specific; RFC 6113
107 TD-REQ-NONCE INTEGER; RFC 6113
108 TD-REQ-SEQ INTEGER; RFC 6113
109 TD_DH_PARAMETERS RFC 4556
110 Unassigned
111 TD-CMS-DIGEST-ALGORITHMS RFC 8636
112 TD-CERT-DIGEST-ALGORITHMS RFC 8636
113-127 Unassigned
128 PA-PAC-REQUEST MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
129 PA-FOR_USER MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
130 PA-FOR-X509-USER MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
131 PA-FOR-CHECK_DUPS MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
132 PA-AS-CHECKSUM MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
133 PA-FX-COOKIE RFC 6113
134 PA-AUTHENTICATION-SET RFC 6113
135 PA-AUTH-SET-SELECTED RFC 6113
136 PA-FX-FAST RFC 6113
137 PA-FX-ERROR RFC 6113
138 PA-ENCRYPTED-CHALLENGE RFC 6113
139-140 Unassigned
141 PA-OTP-CHALLENGE RFC 6560
142 PA-OTP-REQUEST RFC 6560
143 PA-OTP-CONFIRM (OBSOLETED) RFC 6560
144 PA-OTP-PIN-CHANGE RFC 6560
145 PA-EPAK-AS-REQ (sshock@gmail.com); RFC 6113
146 PA-EPAK-AS-REP (sshock@gmail.com); RFC 6113
147 PA_PKINIT_KX RFC 8062
148 PA_PKU2U_NAME draft-zhu-pku2u-09
149 PA-REQ-ENC-PA-REP RFC 6806
150 PA_AS_FRESHNESS RFC 8070
151 PA-SPAKE RFC 9588
152 PA-REDHAT-IDP-OAUTH2 Pavel Březina
153 PA-REDHAT-PASSKEY Pavel Březina
154-164 Unassigned
165 PA-SUPPORTED-ETYPES MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx
166 PA-EXTENDED_ERROR MSKILE; http://msdn2.microsoft.com/en-us/library/cc206927.aspx

FAST Armor Types

Registration Procedure(s)

  • Standards Action

Reference

  • RFC 6113: A Generalized Framework for Kerberos Pre-Authentication

Available Formats

Type Name Description Reference
0 Reserved Reserved RFC 6113
1 FX_FAST_ARMOR_AP_REQUEST Ticket armor using an ap-req. RFC 6113

FAST Options

Registration Procedure(s)

  • Standards Action

Reference

  • RFC 6113: A Generalized Framework for Kerberos Pre-Authentication

Available Formats

Type Name Description Reference
0 RESERVED Reserved for future expansion of this field. RFC 6113
1 hide-client-names Requesting the KDC to hide client names in the KDC response RFC 6113
16 kdc-follow-referrals reserved RFC 6113

Well-Known Kerberos Principal Names

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Unassigned

Reference

  • RFC 6111: Additional Kerberos Naming Constraints

Available Formats

Well-Known Kerberos Principal Name Reference
anonymous RFC 8062

Well-Known Kerberos Realm Names

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Unassigned

Reference

  • RFC 6111: Additional Kerberos Naming Constraints

Available Formats

Well-Known Kerberos Realm Name Reference
anonymous RFC 8062

Kerberos Message Transport Types

Registration Procedure(s)

  • IETF Review

Reference

Available Formats

Value Description Reference
0 Reserved RFC 6784
1 UDP RFC 6784
2 TCP RFC 6784
3 TLS RFC 6784
4-254 Unassigned
255 Reserved RFC 6784

Kerberos Second Factor Types

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Simo Sorce, Greg Hudson

Reference

  • RFC 9588: Kerberos Simple Password-Authenticated Key Exchange (SPAKE) Pre-authentication

Note

Registration requests should be sent to the mailing list described in RFC 9588. If approved, designated experts should notify IANA within three weeks. For assistance, please contact iana@iana.org.

Note

These are signed integers ranging from -2147483648 to 2147483647, inclusive. Positive values must be assigned only for algorithms specified in accordance with these rules for use with Kerberos and related protocols. Negative values should be used for private and experimental algorithms only. Zero is reserved and must not be assigned. Values should be assigned in increasing order.

Available Formats

ID Number Name Reference
0 Reserved RFC 9588
1 SF-NONE RFC 9588

Kerberos SPAKE Groups

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Simo Sorce, Greg Hudson

Reference

  • RFC 9588: Kerberos Simple Password-Authenticated Key Exchange (SPAKE) Pre-authentication

Note

Registration requests should be sent to the mailing list described in RFC 9588. If approved, designated experts should notify IANA within three weeks. For assistance, please contact iana@iana.org.

Note

These are signed integers ranging from -2147483648 to 2147483647, inclusive. Positive values must be assigned only for algorithms specified in accordance with these rules for use with Kerberos and related protocols. Negative values should be used for private and experimental algorithms only. Zero is reserved and must not be assigned. Values should be assigned in increasing order.

Available Formats

ID Number Name Serialization Multiplier Length Multiplier Conversion SPAKE M Constant SPAKE N Constant Hash Function Reference
0 Reserved RFC 9588
1 edwards25519 RFC 8032, Section 3.1 32 RFC 8032, Section 3.1 d048032c6ea0b6d697ddc2e86bda85a33adac920f1bf18e1b0c6d166a5cecdaf d3bfb518f44f3430f29d0c92af503865a1ed3281dc69b35dd868ba85f886c4ab SHA-256 RFC 6234 RFC 7748, Section 4.1; (edwards25519)
2 P-256 SECG-SEC1, Section 2.3.3; (compressed format) 32 SECG-SEC1, Section 2.3.8 02886e2f97ace46e55ba9dd7242579f2993b64e16ef3dcab95afd497333d8fa12f 03d8bbd6c639c62937b04d997f38c3770719c629d7014d49a24b4f98baa1292b49 SHA-256 RFC 6234 SECG-SEC2, Section 2.4.2
3 P-384 SECG-SEC1, Section 2.3.3; (compressed format) 48 SECG-SEC1, Section 2.3.8 030ff0895ae5ebf6187080a82d82b42e2765e3b2f8749c7e05eba366434b363d3dc36f15314739074d2eb8613fceec2853 02c72cf2e390853a1c1c4ad816a62fd15824f56078918f43f922ca21518f9c543bb252c5490214cf9aa3f0baab4b665c10 SHA-384 RFC 6234 SECG-SEC2, Section 2.5.1
4 P-521 SECG-SEC1, Section 2.3.3; (compressed format) 48 SECG-SEC1, Section 2.3.8 02003f06f38131b2ba2600791e82488e8d20ab889af753a41806c5db18d37d85608cfae06b82e4a72cd744c719193562a653ea1f119eef9356907edc9b56979962d7aa 0200c7924b9ec017f3094562894336a53c50167ba8c5963876880542bc669e494b2532d76c5b53dfb349fdf69154b9e0048c58a42e8ed04cef052a3bc349d95575cd25 SHA-512 RFC 6234 SECG-SEC2, Section 2.6.1

Contact Information

Name Contact URI Last Updated
Pavel Březina pbrezina&redhat.com 2023-03-29