Search RFCs

RFC Editor

File formats:

Status:

PROPOSED STANDARD

Updates:

RFC 4556

Authors:

L. Hornquist Astrand
L. Zhu
M. Cullen
G. Hudson

Stream:

IETF

Source:

kitten (sec)

Cite this RFC:TXT  | XML  |  BibTeX

DOI:  https://doi.org/10.17487/RFC8636

Discuss this RFC: Send questions or comments to the mailing listkitten@ietf.org

Other actions:View Errata  | Submit Errata  | Find IPR Disclosures from the IETF  | View History of RFC 8636

Abstract

This document updates the Public Key Cryptography for InitialAuthentication in Kerberos (PKINIT) standard (RFC 4556) to removeprotocol structures tied to specific cryptographic algorithms. ThePKINIT key derivation function is made negotiable, and the digestalgorithms for signing the pre-authentication data and the client'sX.509 certificates are made discoverable.

These changes provide preemptive protection against vulnerabilitiesdiscovered in the future in any specific cryptographic algorithm andallow incremental deployment of newer algorithms.

For the definition ofStatus,seeRFC 2026.

For the definition ofStream, seeRFC 8729.