This document describes Kerberos extensions for client anonymity
support. These extensions give Kerberos clients the ability to
authenticate and securely communicate with a service, without revealing
the client identity. Two methods are described; one that only reveals
the clientâs identity to its own KDC, and another that utilizes
anonymous PKINIT to hide the client identity completely.
Working Group Summary
There is consensus among the WG for this document, and as a âbisâ
document all errata have been considered. Aside from a few editorial
corrections, there are three primary changes to the
specification. First, when using the anonymous PKINIT method, the
ticket session key is derived using the KRB-FX-CF2 operation, which
requires two input constants âpepper1â and âpepper2â. The
âpepper2â constant was incorrect in RFC 6112 and has been chang
ed to its correct value. Second, the need for setting the anonymous
KDC flag in a anonymous TGS request changed from a MUST to a
SHOULD. Third, a new paragraph has been added which clarifies a MITM
scenario that is prevented by the anonymous PKINIT session-key
This is request for publication of a Standards Track document to
obsolete RFC 6112, which had technical errors that made the described
extensions inoperable with existing implementations.
Matt Rogers is the document shepherd. Stephen Farrell is the
responsible Area Director.