3 KERBEROS5 DEFINITIONS ::=
17 AuthorizationDataElement,
48 KRB5SignedPathPrincipals,
56 PA-ClientCanonicalized,
57 PA-ClientCanonicalizedNames,
62 PA-SERVER-REFERRAL-DATA,
63 PA-ServerReferralData,
78 NAME-TYPE ::= INTEGER {
79 KRB5_NT_UNKNOWN(0), -- Name type not known
80 KRB5_NT_PRINCIPAL(1), -- Just the name of the principal as in
81 KRB5_NT_SRV_INST(2), -- Service and other unique instance (krbtgt)
82 KRB5_NT_SRV_HST(3), -- Service with host name as instance
83 KRB5_NT_SRV_XHST(4), -- Service with host as remaining components
84 KRB5_NT_UID(5), -- Unique ID
85 KRB5_NT_X500_PRINCIPAL(6), -- PKINIT
86 KRB5_NT_SMTP_NAME(7), -- Name in form of SMTP email name
87 KRB5_NT_ENTERPRISE_PRINCIPAL(10), -- Windows 2000 UPN
88 KRB5_NT_WELLKNOWN(11), -- Wellknown
89 KRB5_NT_ENT_PRINCIPAL_AND_ID(-130), -- Windows 2000 UPN and SID
90 KRB5_NT_MS_PRINCIPAL(-128), -- NT 4 style name
91 KRB5_NT_MS_PRINCIPAL_AND_ID(-129), -- NT style name and SID
92 KRB5_NT_NTLM(-1200) -- NTLM name, realm is domain
97 MESSAGE-TYPE ::= INTEGER {
98 krb-as-req(10), -- Request for initial authentication
99 krb-as-rep(11), -- Response to KRB_AS_REQ request
100 krb-tgs-req(12), -- Request for authentication based on TGT
101 krb-tgs-rep(13), -- Response to KRB_TGS_REQ request
102 krb-ap-req(14), -- application request to server
103 krb-ap-rep(15), -- Response to KRB_AP_REQ_MUTUAL
104 krb-safe(20), -- Safe (checksummed) application message
105 krb-priv(21), -- Private (encrypted) application message
106 krb-cred(22), -- Private (encrypted) message to forward credentials
107 krb-error(30) -- Error response
113 PADATA-TYPE ::= INTEGER {
115 KRB5-PADATA-TGS-REQ(1),
116 KRB5-PADATA-AP-REQ(1),
117 KRB5-PADATA-ENC-TIMESTAMP(2),
118 KRB5-PADATA-PW-SALT(3),
119 KRB5-PADATA-ENC-UNIX-TIME(5),
120 KRB5-PADATA-SANDIA-SECUREID(6),
121 KRB5-PADATA-SESAME(7),
122 KRB5-PADATA-OSF-DCE(8),
123 KRB5-PADATA-CYBERSAFE-SECUREID(9),
124 KRB5-PADATA-AFS3-SALT(10),
125 KRB5-PADATA-ETYPE-INFO(11),
126 KRB5-PADATA-SAM-CHALLENGE(12), -- (sam/otp)
127 KRB5-PADATA-SAM-RESPONSE(13), -- (sam/otp)
128 KRB5-PADATA-PK-AS-REQ-19(14), -- (PKINIT-19)
129 KRB5-PADATA-PK-AS-REP-19(15), -- (PKINIT-19)
130 KRB5-PADATA-PK-AS-REQ-WIN(15), -- (PKINIT - old number)
131 KRB5-PADATA-PK-AS-REQ(16), -- (PKINIT-25)
132 KRB5-PADATA-PK-AS-REP(17), -- (PKINIT-25)
133 KRB5-PADATA-PA-PK-OCSP-RESPONSE(18),
134 KRB5-PADATA-ETYPE-INFO2(19),
135 KRB5-PADATA-USE-SPECIFIED-KVNO(20),
136 KRB5-PADATA-SVR-REFERRAL-INFO(20), --- old ms referral number
137 KRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp)
138 KRB5-PADATA-GET-FROM-TYPED-DATA(22),
139 KRB5-PADATA-SAM-ETYPE-INFO(23),
140 KRB5-PADATA-SERVER-REFERRAL(25),
141 KRB5-PADATA-ALT-PRINC(24), -- (crawdad@fnal.gov)
142 KRB5-PADATA-SAM-CHALLENGE2(30), -- (kenh@pobox.com)
143 KRB5-PADATA-SAM-RESPONSE2(31), -- (kenh@pobox.com)
144 KRB5-PA-EXTRA-TGT(41), -- Reserved extra TGT
145 KRB5-PADATA-TD-KRB-PRINCIPAL(102), -- PrincipalName
146 KRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS(104), -- PKINIT
147 KRB5-PADATA-PK-TD-CERTIFICATE-INDEX(105), -- PKINIT
148 KRB5-PADATA-TD-APP-DEFINED-ERROR(106), -- application specific
149 KRB5-PADATA-TD-REQ-NONCE(107), -- INTEGER
150 KRB5-PADATA-TD-REQ-SEQ(108), -- INTEGER
151 KRB5-PADATA-PA-PAC-REQUEST(128), -- jbrezak@exchange.microsoft.com
152 KRB5-PADATA-FOR-USER(129), -- MS-KILE
153 KRB5-PADATA-FOR-X509-USER(130), -- MS-KILE
154 KRB5-PADATA-FOR-CHECK-DUPS(131), -- MS-KILE
155 KRB5-PADATA-AS-CHECKSUM(132), -- MS-KILE
156 KRB5-PADATA-PK-AS-09-BINDING(132), -- client send this to
157 -- tell KDC that is supports
158 -- the asCheckSum in the
160 KRB5-PADATA-CLIENT-CANONICALIZED(133), -- referals
161 KRB5-PADATA-FX-COOKIE(133), -- krb-wg-preauth-framework
162 KRB5-PADATA-AUTHENTICATION-SET(134), -- krb-wg-preauth-framework
163 KRB5-PADATA-AUTH-SET-SELECTED(135), -- krb-wg-preauth-framework
164 KRB5-PADATA-FX-FAST(136), -- krb-wg-preauth-framework
165 KRB5-PADATA-FX-ERROR(137), -- krb-wg-preauth-framework
166 KRB5-PADATA-ENCRYPTED-CHALLENGE(138), -- krb-wg-preauth-framework
167 KRB5-PADATA-OTP-CHALLENGE(141), -- (gareth.richards@rsa.com)
168 KRB5-PADATA-OTP-REQUEST(142), -- (gareth.richards@rsa.com)
169 KBB5-PADATA-OTP-CONFIRM(143), -- (gareth.richards@rsa.com)
170 KRB5-PADATA-OTP-PIN-CHANGE(144), -- (gareth.richards@rsa.com)
171 KRB5-PADATA-EPAK-AS-REQ(145),
172 KRB5-PADATA-EPAK-AS-REP(146),
173 KRB5-PADATA-PKINIT-KX(147), -- krb-wg-anon
174 KRB5-PADATA-PKU2U-NAME(148), -- zhu-pku2u
175 KRB5-PADATA-SUPPORTED-ETYPES(165) -- MS-KILE
178 AUTHDATA-TYPE ::= INTEGER {
179 KRB5-AUTHDATA-IF-RELEVANT(1),
180 KRB5-AUTHDATA-INTENDED-FOR_SERVER(2),
181 KRB5-AUTHDATA-INTENDED-FOR-APPLICATION-CLASS(3),
182 KRB5-AUTHDATA-KDC-ISSUED(4),
183 KRB5-AUTHDATA-AND-OR(5),
184 KRB5-AUTHDATA-MANDATORY-TICKET-EXTENSIONS(6),
185 KRB5-AUTHDATA-IN-TICKET-EXTENSIONS(7),
186 KRB5-AUTHDATA-MANDATORY-FOR-KDC(8),
187 KRB5-AUTHDATA-INITIAL-VERIFIED-CAS(9),
188 KRB5-AUTHDATA-OSF-DCE(64),
189 KRB5-AUTHDATA-SESAME(65),
190 KRB5-AUTHDATA-OSF-DCE-PKI-CERTID(66),
191 KRB5-AUTHDATA-WIN2K-PAC(128),
192 KRB5-AUTHDATA-GSS-API-ETYPE-NEGOTIATION(129), -- Authenticator only
193 KRB5-AUTHDATA-SIGNTICKET-OLDER(-17),
194 KRB5-AUTHDATA-SIGNTICKET-OLD(142),
195 KRB5-AUTHDATA-SIGNTICKET(512)
200 CKSUMTYPE ::= INTEGER {
203 CKSUMTYPE_RSA_MD4(2),
204 CKSUMTYPE_RSA_MD4_DES(3),
205 CKSUMTYPE_DES_MAC(4),
206 CKSUMTYPE_DES_MAC_K(5),
207 CKSUMTYPE_RSA_MD4_DES_K(6),
208 CKSUMTYPE_RSA_MD5(7),
209 CKSUMTYPE_RSA_MD5_DES(8),
210 CKSUMTYPE_RSA_MD5_DES3(9),
211 CKSUMTYPE_SHA1_OTHER(10),
212 CKSUMTYPE_HMAC_SHA1_DES3(12),
214 CKSUMTYPE_HMAC_SHA1_96_AES_128(15),
215 CKSUMTYPE_HMAC_SHA1_96_AES_256(16),
216 CKSUMTYPE_GSSAPI(0x8003),
217 CKSUMTYPE_HMAC_MD5(-138), -- unofficial microsoft number
218 CKSUMTYPE_HMAC_MD5_ENC(-1138) -- even more unofficial
222 ENCTYPE ::= INTEGER {
224 ETYPE_DES_CBC_CRC(1),
225 ETYPE_DES_CBC_MD4(2),
226 ETYPE_DES_CBC_MD5(3),
227 ETYPE_DES3_CBC_MD5(5),
228 ETYPE_OLD_DES3_CBC_SHA1(7),
229 ETYPE_SIGN_DSA_GENERATE(8),
230 ETYPE_ENCRYPT_RSA_PRIV(9),
231 ETYPE_ENCRYPT_RSA_PUB(10),
232 ETYPE_DES3_CBC_SHA1(16), -- with key derivation
233 ETYPE_AES128_CTS_HMAC_SHA1_96(17),
234 ETYPE_AES256_CTS_HMAC_SHA1_96(18),
235 ETYPE_ARCFOUR_HMAC_MD5(23),
236 ETYPE_ARCFOUR_HMAC_MD5_56(24),
237 ETYPE_ENCTYPE_PK_CROSS(48),
238 -- some "old" windows types
239 ETYPE_ARCFOUR_MD4(-128),
240 ETYPE_ARCFOUR_HMAC_OLD(-133),
241 ETYPE_ARCFOUR_HMAC_OLD_EXP(-135),
242 -- these are for Heimdal internal use
243 ETYPE_DES_CBC_NONE(-0x1000),
244 ETYPE_DES3_CBC_NONE(-0x1001),
245 ETYPE_DES_CFB64_NONE(-0x1002),
246 ETYPE_DES_PCBC_NONE(-0x1003),
247 ETYPE_DIGEST_MD5_NONE(-0x1004), -- private use, lukeh@padl.com
248 ETYPE_CRAM_MD5_NONE(-0x1005) -- private use, lukeh@padl.com
254 -- this is sugar to make something ASN1 does not have: unsigned
256 krb5uint32 ::= INTEGER (0..4294967295)
257 krb5int32 ::= INTEGER (-2147483648..2147483647)
259 KerberosString ::= GeneralString
261 Realm ::= GeneralString
262 PrincipalName ::= SEQUENCE {
263 name-type[0] NAME-TYPE,
264 name-string[1] SEQUENCE OF GeneralString
267 -- this is not part of RFC1510
268 Principal ::= SEQUENCE {
269 name[0] PrincipalName,
273 Principals ::= SEQUENCE OF Principal
275 HostAddress ::= SEQUENCE {
276 addr-type[0] krb5int32,
277 address[1] OCTET STRING
280 -- This is from RFC1510.
282 -- HostAddresses ::= SEQUENCE OF SEQUENCE {
283 -- addr-type[0] krb5int32,
284 -- address[1] OCTET STRING
287 -- This seems much better.
288 HostAddresses ::= SEQUENCE OF HostAddress
291 KerberosTime ::= GeneralizedTime -- Specifying UTC time zone (Z)
293 AuthorizationDataElement ::= SEQUENCE {
294 ad-type[0] krb5int32,
295 ad-data[1] OCTET STRING
298 AuthorizationData ::= SEQUENCE OF AuthorizationDataElement
300 APOptions ::= BIT STRING {
306 TicketFlags ::= BIT STRING {
319 transited-policy-checked(12),
324 KDCOptions ::= BIT STRING {
333 request-anonymous(14),
335 constrained-delegation(16), -- ms extension
336 disable-transited-check(26),
343 LR-TYPE ::= INTEGER {
344 LR_NONE(0), -- no information
345 LR_INITIAL_TGT(1), -- last initial TGT request
346 LR_INITIAL(2), -- last initial request
347 LR_ISSUE_USE_TGT(3), -- time of newest TGT used
348 LR_RENEWAL(4), -- time of last renewal
349 LR_REQUEST(5), -- time of last request (of any type)
350 LR_PW_EXPTIME(6), -- expiration time of password
351 LR_ACCT_EXPTIME(7) -- expiration time of account
354 LastReq ::= SEQUENCE OF SEQUENCE {
356 lr-value[1] KerberosTime
360 EncryptedData ::= SEQUENCE {
361 etype[0] ENCTYPE, -- EncryptionType
362 kvno[1] krb5int32 OPTIONAL,
363 cipher[2] OCTET STRING -- ciphertext
366 EncryptionKey ::= SEQUENCE {
367 keytype[0] krb5int32,
368 keyvalue[1] OCTET STRING
371 -- encoded Transited field
372 TransitedEncoding ::= SEQUENCE {
373 tr-type[0] krb5int32, -- must be registered
374 contents[1] OCTET STRING
377 Ticket ::= [APPLICATION 1] SEQUENCE {
378 tkt-vno[0] krb5int32,
380 sname[2] PrincipalName,
381 enc-part[3] EncryptedData
383 -- Encrypted part of ticket
384 EncTicketPart ::= [APPLICATION 3] SEQUENCE {
385 flags[0] TicketFlags,
386 key[1] EncryptionKey,
388 cname[3] PrincipalName,
389 transited[4] TransitedEncoding,
390 authtime[5] KerberosTime,
391 starttime[6] KerberosTime OPTIONAL,
392 endtime[7] KerberosTime,
393 renew-till[8] KerberosTime OPTIONAL,
394 caddr[9] HostAddresses OPTIONAL,
395 authorization-data[10] AuthorizationData OPTIONAL
398 Checksum ::= SEQUENCE {
399 cksumtype[0] CKSUMTYPE,
400 checksum[1] OCTET STRING
403 Authenticator ::= [APPLICATION 2] SEQUENCE {
404 authenticator-vno[0] krb5int32,
406 cname[2] PrincipalName,
407 cksum[3] Checksum OPTIONAL,
409 ctime[5] KerberosTime,
410 subkey[6] EncryptionKey OPTIONAL,
411 seq-number[7] krb5uint32 OPTIONAL,
412 authorization-data[8] AuthorizationData OPTIONAL
415 PA-DATA ::= SEQUENCE {
416 -- might be encoded AP-REQ
417 padata-type[1] PADATA-TYPE,
418 padata-value[2] OCTET STRING
421 ETYPE-INFO-ENTRY ::= SEQUENCE {
423 salt[1] OCTET STRING OPTIONAL,
424 salttype[2] krb5int32 OPTIONAL
427 ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY
429 ETYPE-INFO2-ENTRY ::= SEQUENCE {
431 salt[1] KerberosString OPTIONAL,
432 s2kparams[2] OCTET STRING OPTIONAL
435 ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY
437 METHOD-DATA ::= SEQUENCE OF PA-DATA
439 TypedData ::= SEQUENCE {
440 data-type[0] krb5int32,
441 data-value[1] OCTET STRING OPTIONAL
444 TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF TypedData
446 KDC-REQ-BODY ::= SEQUENCE {
447 kdc-options[0] KDCOptions,
448 cname[1] PrincipalName OPTIONAL, -- Used only in AS-REQ
449 realm[2] Realm, -- Server's realm
450 -- Also client's in AS-REQ
451 sname[3] PrincipalName OPTIONAL,
452 from[4] KerberosTime OPTIONAL,
453 till[5] KerberosTime OPTIONAL,
454 rtime[6] KerberosTime OPTIONAL,
456 etype[8] SEQUENCE OF ENCTYPE, -- EncryptionType,
457 -- in preference order
458 addresses[9] HostAddresses OPTIONAL,
459 enc-authorization-data[10] EncryptedData OPTIONAL,
460 -- Encrypted AuthorizationData encoding
461 additional-tickets[11] SEQUENCE OF Ticket OPTIONAL
464 KDC-REQ ::= SEQUENCE {
466 msg-type[2] MESSAGE-TYPE,
467 padata[3] METHOD-DATA OPTIONAL,
468 req-body[4] KDC-REQ-BODY
471 AS-REQ ::= [APPLICATION 10] KDC-REQ
472 TGS-REQ ::= [APPLICATION 12] KDC-REQ
474 -- padata-type ::= PA-ENC-TIMESTAMP
475 -- padata-value ::= EncryptedData - PA-ENC-TS-ENC
477 PA-ENC-TS-ENC ::= SEQUENCE {
478 patimestamp[0] KerberosTime, -- client's time
479 pausec[1] krb5int32 OPTIONAL
482 -- draft-brezak-win2k-krb-authz-01
483 PA-PAC-REQUEST ::= SEQUENCE {
484 include-pac[0] BOOLEAN -- Indicates whether a PAC
485 -- should be included or not
488 -- PacketCable provisioning server location, PKT-SP-SEC-I09-030728.pdf
489 PROV-SRV-LOCATION ::= GeneralString
491 KDC-REP ::= SEQUENCE {
493 msg-type[1] MESSAGE-TYPE,
494 padata[2] METHOD-DATA OPTIONAL,
496 cname[4] PrincipalName,
498 enc-part[6] EncryptedData
501 AS-REP ::= [APPLICATION 11] KDC-REP
502 TGS-REP ::= [APPLICATION 13] KDC-REP
504 EncKDCRepPart ::= SEQUENCE {
505 key[0] EncryptionKey,
508 key-expiration[3] KerberosTime OPTIONAL,
509 flags[4] TicketFlags,
510 authtime[5] KerberosTime,
511 starttime[6] KerberosTime OPTIONAL,
512 endtime[7] KerberosTime,
513 renew-till[8] KerberosTime OPTIONAL,
515 sname[10] PrincipalName,
516 caddr[11] HostAddresses OPTIONAL,
517 encrypted-pa-data[12] METHOD-DATA OPTIONAL
520 EncASRepPart ::= [APPLICATION 25] EncKDCRepPart
521 EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart
523 AP-REQ ::= [APPLICATION 14] SEQUENCE {
525 msg-type[1] MESSAGE-TYPE,
526 ap-options[2] APOptions,
528 authenticator[4] EncryptedData
531 AP-REP ::= [APPLICATION 15] SEQUENCE {
533 msg-type[1] MESSAGE-TYPE,
534 enc-part[2] EncryptedData
537 EncAPRepPart ::= [APPLICATION 27] SEQUENCE {
538 ctime[0] KerberosTime,
540 subkey[2] EncryptionKey OPTIONAL,
541 seq-number[3] krb5uint32 OPTIONAL
544 KRB-SAFE-BODY ::= SEQUENCE {
545 user-data[0] OCTET STRING,
546 timestamp[1] KerberosTime OPTIONAL,
547 usec[2] krb5int32 OPTIONAL,
548 seq-number[3] krb5uint32 OPTIONAL,
549 s-address[4] HostAddress OPTIONAL,
550 r-address[5] HostAddress OPTIONAL
553 KRB-SAFE ::= [APPLICATION 20] SEQUENCE {
555 msg-type[1] MESSAGE-TYPE,
556 safe-body[2] KRB-SAFE-BODY,
560 KRB-PRIV ::= [APPLICATION 21] SEQUENCE {
562 msg-type[1] MESSAGE-TYPE,
563 enc-part[3] EncryptedData
565 EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE {
566 user-data[0] OCTET STRING,
567 timestamp[1] KerberosTime OPTIONAL,
568 usec[2] krb5int32 OPTIONAL,
569 seq-number[3] krb5uint32 OPTIONAL,
570 s-address[4] HostAddress OPTIONAL, -- sender's addr
571 r-address[5] HostAddress OPTIONAL -- recip's addr
574 KRB-CRED ::= [APPLICATION 22] SEQUENCE {
576 msg-type[1] MESSAGE-TYPE, -- KRB_CRED
577 tickets[2] SEQUENCE OF Ticket,
578 enc-part[3] EncryptedData
581 KrbCredInfo ::= SEQUENCE {
582 key[0] EncryptionKey,
583 prealm[1] Realm OPTIONAL,
584 pname[2] PrincipalName OPTIONAL,
585 flags[3] TicketFlags OPTIONAL,
586 authtime[4] KerberosTime OPTIONAL,
587 starttime[5] KerberosTime OPTIONAL,
588 endtime[6] KerberosTime OPTIONAL,
589 renew-till[7] KerberosTime OPTIONAL,
590 srealm[8] Realm OPTIONAL,
591 sname[9] PrincipalName OPTIONAL,
592 caddr[10] HostAddresses OPTIONAL
595 EncKrbCredPart ::= [APPLICATION 29] SEQUENCE {
596 ticket-info[0] SEQUENCE OF KrbCredInfo,
597 nonce[1] krb5int32 OPTIONAL,
598 timestamp[2] KerberosTime OPTIONAL,
599 usec[3] krb5int32 OPTIONAL,
600 s-address[4] HostAddress OPTIONAL,
601 r-address[5] HostAddress OPTIONAL
604 KRB-ERROR ::= [APPLICATION 30] SEQUENCE {
606 msg-type[1] MESSAGE-TYPE,
607 ctime[2] KerberosTime OPTIONAL,
608 cusec[3] krb5int32 OPTIONAL,
609 stime[4] KerberosTime,
611 error-code[6] krb5int32,
612 crealm[7] Realm OPTIONAL,
613 cname[8] PrincipalName OPTIONAL,
614 realm[9] Realm, -- Correct realm
615 sname[10] PrincipalName, -- Correct name
616 e-text[11] GeneralString OPTIONAL,
617 e-data[12] OCTET STRING OPTIONAL
620 ChangePasswdDataMS ::= SEQUENCE {
621 newpasswd[0] OCTET STRING,
622 targname[1] PrincipalName OPTIONAL,
623 targrealm[2] Realm OPTIONAL
626 EtypeList ::= SEQUENCE OF krb5int32
627 -- the client's proposed enctype list in
628 -- decreasing preference order, favorite choice first
630 krb5-pvno krb5int32 ::= 5 -- current Kerberos protocol version number
632 -- transited encodings
634 DOMAIN-X500-COMPRESS krb5int32 ::= 1
636 -- authorization data primitives
638 AD-IF-RELEVANT ::= AuthorizationData
640 AD-KDCIssued ::= SEQUENCE {
641 ad-checksum[0] Checksum,
642 i-realm[1] Realm OPTIONAL,
643 i-sname[2] PrincipalName OPTIONAL,
644 elements[3] AuthorizationData
647 AD-AND-OR ::= SEQUENCE {
648 condition-count[0] INTEGER,
649 elements[1] AuthorizationData
652 AD-MANDATORY-FOR-KDC ::= AuthorizationData
654 -- PA-SAM-RESPONSE-2/PA-SAM-RESPONSE-2
656 PA-SAM-TYPE ::= INTEGER {
657 PA_SAM_TYPE_ENIGMA(1), -- Enigma Logic
658 PA_SAM_TYPE_DIGI_PATH(2), -- Digital Pathways
659 PA_SAM_TYPE_SKEY_K0(3), -- S/key where KDC has key 0
660 PA_SAM_TYPE_SKEY(4), -- Traditional S/Key
661 PA_SAM_TYPE_SECURID(5), -- Security Dynamics
662 PA_SAM_TYPE_CRYPTOCARD(6) -- CRYPTOCard
665 PA-SAM-REDIRECT ::= HostAddresses
667 SAMFlags ::= BIT STRING {
669 send-encrypted-sad(1),
670 must-pk-encrypt-sad(2)
673 PA-SAM-CHALLENGE-2-BODY ::= SEQUENCE {
674 sam-type[0] krb5int32,
675 sam-flags[1] SAMFlags,
676 sam-type-name[2] GeneralString OPTIONAL,
677 sam-track-id[3] GeneralString OPTIONAL,
678 sam-challenge-label[4] GeneralString OPTIONAL,
679 sam-challenge[5] GeneralString OPTIONAL,
680 sam-response-prompt[6] GeneralString OPTIONAL,
681 sam-pk-for-sad[7] EncryptionKey OPTIONAL,
682 sam-nonce[8] krb5int32,
683 sam-etype[9] krb5int32,
687 PA-SAM-CHALLENGE-2 ::= SEQUENCE {
688 sam-body[0] PA-SAM-CHALLENGE-2-BODY,
689 sam-cksum[1] SEQUENCE OF Checksum, -- (1..MAX)
693 PA-SAM-RESPONSE-2 ::= SEQUENCE {
694 sam-type[0] krb5int32,
695 sam-flags[1] SAMFlags,
696 sam-track-id[2] GeneralString OPTIONAL,
697 sam-enc-nonce-or-sad[3] EncryptedData, -- PA-ENC-SAM-RESPONSE-ENC
698 sam-nonce[4] krb5int32,
702 PA-ENC-SAM-RESPONSE-ENC ::= SEQUENCE {
703 sam-nonce[0] krb5int32,
704 sam-sad[1] GeneralString OPTIONAL,
708 PA-S4U2Self ::= SEQUENCE {
709 name[0] PrincipalName,
712 auth[3] GeneralString
715 -- never encoded on the wire, just used to checksum over
716 KRB5SignedPathData ::= SEQUENCE {
717 client[0] Principal OPTIONAL,
718 authtime[1] KerberosTime,
719 delegated[2] Principals OPTIONAL,
720 method_data[3] METHOD-DATA OPTIONAL
723 KRB5SignedPath ::= SEQUENCE {
724 -- DERcoded KRB5SignedPathData
725 -- krbtgt key (etype), KeyUsage = XXX
728 -- srvs delegated though
729 delegated[2] Principals OPTIONAL,
730 method_data[3] METHOD-DATA OPTIONAL
733 PA-ClientCanonicalizedNames ::= SEQUENCE{
734 requested-name [0] PrincipalName,
735 mapped-name [1] PrincipalName
738 PA-ClientCanonicalized ::= SEQUENCE {
739 names [0] PA-ClientCanonicalizedNames,
740 canon-checksum [1] Checksum
743 AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD --
744 login-alias [0] PrincipalName,
745 checksum [1] Checksum
749 PA-SvrReferralData ::= SEQUENCE {
750 referred-name [1] PrincipalName OPTIONAL,
751 referred-realm [0] Realm
754 PA-SERVER-REFERRAL-DATA ::= EncryptedData
756 PA-ServerReferralData ::= SEQUENCE {
757 referred-realm [0] Realm OPTIONAL,
758 true-principal-name [1] PrincipalName OPTIONAL,
759 requested-principal-name [2] PrincipalName OPTIONAL,
760 referral-valid-until [3] KerberosTime OPTIONAL,
764 FastOptions ::= BIT STRING {
766 hide-client-names(1),
767 kdc-follow--referrals(16)
770 KrbFastReq ::= SEQUENCE {
771 fast-options [0] FastOptions,
772 padata [1] SEQUENCE OF PA-DATA,
773 req-body [2] KDC-REQ-BODY,
777 KrbFastArmor ::= SEQUENCE {
778 armor-type [0] krb5int32,
779 armor-value [1] OCTET STRING,
783 KrbFastArmoredReq ::= SEQUENCE {
784 armor [0] KrbFastArmor OPTIONAL,
785 req-checksum [1] Checksum,
786 enc-fast-req [2] EncryptedData -- KrbFastReq --
789 PA-FX-FAST-REQUEST ::= CHOICE {
790 armored-data [0] KrbFastArmoredReq,
794 KrbFastFinished ::= SEQUENCE {
795 timestamp [0] KerberosTime,
798 cname [3] PrincipalName,
799 checksum [4] Checksum,
800 ticket-checksum [5] Checksum,
804 KrbFastResponse ::= SEQUENCE {
805 padata [0] SEQUENCE OF PA-DATA,
806 rep-key [1] EncryptionKey OPTIONAL,
807 finished [2] KrbFastFinished OPTIONAL,
811 KrbFastArmoredRep ::= SEQUENCE {
812 enc-fast-rep [0] EncryptedData, -- KrbFastResponse --
816 PA-FX-FAST-REPLY ::= CHOICE {
817 armored-data [0] KrbFastArmoredRep,
823 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1