KRB_KDC_REQ Definition

The KRB_KDC_REQ message has no type of its own. Instead, its type is either KRB_AS_REQ or KRB_TGS_REQ, depending on whether the request is for an initial ticket or an additional ticket. In either case, the message is sent from the client to the Authentication Server to request credentials for a service.

The message fields are as follows:

AS-REQ  = KDC-REQ
TGS-REQ = KDC-REQ

KDC-REQ = {
           pvno[1]               INTEGER,
           msg-type[2]           INTEGER,
           padata[3]             SEQUENCE OF PA-DATA OPTIONAL,
           req-body[4]           KDC-REQ-BODY
          }

PA-DATA = {
           padata-type[1]        INTEGER,
           padata-value[2]       BYTE STRING,
          }
                         -- might be encoded AP-REQ
padata-type  = PA-ENC-TIMESTAMP
padata-value = EncryptedData -- PA-ENC-TS-ENC

PA-ENC-TS-ENC = {
                 patimestamp[0] KerberosTime, -- client’s time
                 pausec[1]      INTEGER OPTIONAL
                }

KDC-REQ-BODY = {
           kdc-options[0] KDCOptions,
           cname[1]       PrincipalName OPTIONAL,
                          -- Used only in AS-REQ
           realm[2]       Realm, -- Server’s realm
                          -- Also client’s in AS-REQ
           sname[3]       PrincipalName OPTIONAL,
           from[4]        KerberosTime OPTIONAL,
           till[5]        KerberosTime,
           rtime[6]       KerberosTime OPTIONAL,
           nonce[7]       INTEGER,
           etype[8]       SEQUENCE OF INTEGER, -- EncryptionType,
                          -- in preference order
           addresses[9]   HostAddresses OPTIONAL,
enc-authorization-data[10]   EncryptedData OPTIONAL,
                          -- Encrypted AuthorizationData encoding
           additional-tickets[11]   SEQUENCE OF Ticket OPTIONAL

The fields in this message are described in table 9.5.

The optional fields are included only if necessary to perform the operation specified in the kdc-options field.

In KRB_TGS_REQ, the protocol version number appears twice and two different message types appear. The KRB_TGS_REQ message contains these fields, as does the authentication header (KRB_AP_RE Q) passed in the padata field.

KRB_KDC_REP Definition

The KRB_KDC_REP message format is used for the reply from the Key Distribution Center for an initial (Authentication Server) request or a subsequent (Ticket Granting Service) request. The message type is KRB_AS_REP or KRB_TGS_REP.

The key used to encrypt the ciphertext part of the reply depends on the message type. For KRB_AS_REP, the ciphertext is encrypted in the client’s secret key, and the client’s key version number is included in the key version number for the encrypted data. For KRB_TGS_REP, the ciphertext is encrypted in the subsession key from the Authenticator, or if absent, the session key from the Ticket Granting Ticket used in the request. In that case, no version number is present in the EncryptedData sequence.

The KRB_KDC_REP message contains the following fields:

AS-REP  =  KDC-REP
TGS-REP =  KDC-REP

KDC-REP = {
           pvno[0]            INTEGER,
           msg-type[1]        INTEGER,
           padata[2]          SEQUENCE OF PA-DATA OPTIONAL,
           crealm[3]          Realm,
           cname[4]           PrincipalName,
           ticket[5]          Tket,
           enc-part[6]        EncryptedData
          }

EncASRepPart  = EncKDCRepPart
EncTGSRepPart = EncKDCRepPart

EncKDCRepPart = {
           key[0]                      EncryptionKey,
           last-req[1]                 LastReq,
           nonce[2]                    INTEGER,
           key-expiration[3]           KerberosTime OPTIONAL,
           flags[4]                    TicketFlags,
           authtime[5]                 KerberosTime,
           starttime[6]                KerberosTime OPTIONAL,
           endtime[7]                  KerberosTime,
           renew-till[8]               KerberosTime OPTIONAL,
           srealm[9]                   Realm,
           sname[10]                   PrincipalName,
           caddr[11]                   HostAddresses OPTIONAL
                }

Table 9.6 describes the fields in this message.