Documentation/crypto/krb5.rst

Source file repositories/reference/linux-study-clean/Documentation/crypto/krb5.rst

File Facts

System
Linux kernel
Corpus path
Documentation/crypto/krb5.rst
Extension
.rst
Size
9271 bytes
Lines
272
Domain
Support Tooling And Documentation
Bucket
Documentation
Inferred role
Support Tooling And Documentation: documentation
Status
atlas-only

Why This File Exists

Repository support layer: documentation, build tooling, samples, user-space helper tools, generated initramfs support, licenses, and validation utilities.

Dependency Surface

Detected Declarations

Annotated Snippet

struct krb5_buffer {
		unsigned int	len;
		void		*data;
	};

Encoding Type
=============

The encoding type is defined by the following structure::

	struct krb5_enctype {
		int		etype;
		int		ctype;
		const char	*name;
		u16		key_bytes;
		u16		key_len;
		u16		Kc_len;
		u16		Ke_len;
		u16		Ki_len;
		u16		prf_len;
		u16		block_len;
		u16		conf_len;
		u16		cksum_len;
		...
	};

The fields of interest to the user of the API are as follows:

  * ``etype`` and ``ctype`` indicate the protocol number for this encoding
    type for encryption and checksumming respectively.  They hold
    ``KRB5_ENCTYPE_*`` and ``KRB5_CKSUMTYPE_*`` constants.

  * ``name`` is the formal name of the encoding.

  * ``key_len`` and ``key_bytes`` are the input key length and the derived key
    length.  (I think they only differ for DES, which isn't supported here).

  * ``Kc_len``, ``Ke_len`` and ``Ki_len`` are the sizes of the derived Kc, Ke
    and Ki keys.  Kc is used for in checksum mode; Ke and Ki are used in
    encryption mode.

  * ``prf_len`` is the size of the result from the PRF+ function calculation.

  * ``block_len``, ``conf_len`` and ``cksum_len`` are the encryption block
    length, confounder length and checksum length respectively.  All three are
    used in encryption mode, but only the checksum length is used in checksum
    mode.

The encoding type is looked up by number using the following function::

	const struct krb5_enctype *crypto_krb5_find_enctype(u32 enctype);

Key Derivation
==============

Once the application has selected an encryption type, the keys that will be
used to do the actual crypto can be derived from the transport key.

PRF+ Calculation
----------------

To aid in key derivation, a function to calculate the Kerberos GSSAPI
mechanism's PRF+ is provided::

	int crypto_krb5_calc_PRFplus(const struct krb5_enctype *krb5,
				     const struct krb5_buffer *K,
				     unsigned int L,
				     const struct krb5_buffer *S,
				     struct krb5_buffer *result,
				     gfp_t gfp);

Annotation

Implementation Notes