Telnet Authentication: Kerberos Version 5(3)

　　The selection of the random session key in the Kerberos V5　authenticator is critical, since this key will be used for encrypting　the telnet data stream if encryption is enabled. It is strongly　advised that the random key selection be done using cryptographic　techniques that involve the Kerberos ticket's session key. For　example, using the current time, encrypting it with the ticket　session key, and then correcting for key parity is a strong way to　generate a subsession key, since the ticket session key is assumed to　be never disclosed to an attacker.

　　Care should be taken before forwarding a user's Kerberos credentials　to the remote server. If the remote server is not trustworthy, this　could result in the user's credentials being compromised. Hence, the　user interface should not forward credentials by default; it would be　far safer to either require the user to explicitly request　credentials forwarding for each connection, or to have a trusted list　of hosts for which credentials forwarding is enabled, but to not　enable credentials forwarding by default for all machines.

　　The IAC SB AUTHENTICATION NAME name IAC SE message is unprotected in　this protocol. Its contents should be verified by a secure method　after authentication completes before it is used.

　　6. IANA Considerations

　　The authentication type KERBEROS_V5 and its associated suboption　values are registered with IANA. Any suboption values used to extend　the protocol as described in this document must be registered with　IANA before use. IANA is instructed not to issue new suboption　values without submission of documentation of their use.

　　7. Acknowledgments

　　This document was originally written by Dave Borman of Cray Research,　Inc. Theodore Ts'o of MIT revised it to reflect the latest　implementation experience. Cliff Neuman and Prasad Upasani of USC's　Information Sciences Institute developed the credential forwarding　support.　In addition, the contributions of the Telnet Working Group are also　gratefully acknowledged.

　　8. References

　　[1] Kohl, J. and B. Neuman, "The Kerberos Network Authentication　System (V5)", RFC1510, September 1993.

　　[2] Ts'o, T. and J. Altman, "Telnet Authentication Option", RFC2941,　September 2000.

　　[3] Ts'o, T., "Telnet Data Encryption Option", RFC2946, September　2000.

　　[4] Postel, J. and J. Reynolds, "Telnet Option Specifications", STD　8, RFC855, May 1983.

　　9. Editor's Address

　　Theodore Ts'o

　　VA Linux Systems

　　43 Pleasant St.

　　Medford, MA 02155

　　Phone: (781) 391-3464

　　EMail: tytso@mit.edu

　　10. Full Copyright Statement

　　Copyright (C) The Internet Society (2000). All Rights Reserved.　

       This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it　or assist in its implementation may be prepared, copied, published　and distributed, in whole or in part, without restriction of any　kind, provided that the above copyright notice and this paragraph are　included on all such copies and derivative works. However, this　document itself may not be modified in any way, such as by removing　the copyright notice or references to the Internet Society or other　Internet organizations, except as needed for the rpose of　developing Internet standards in which case the procedures for　copyrights defined in the Internet Standards process must be　followed, or as required to translate it into languages other than　English.

　　The limited permissions granted above are perpetual and will not be　revoked by the Internet Society or its successors or assigns.

　　This document and the information contained herein is provided on an　"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING　TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING　BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION　HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF　MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

　　Acknowledgement

　　Funding for the RFCEditor function is currently provided by the　Internet Society.