RFC 9588: Kerberos Simple Password-Authenticated Key Exchange (SPAKE) Pre-authentication

This document defines a new pre-authentication mechanism for the Kerberos protocol. The mechanism uses a password-authenticated key exchange (PAKE) to prevent…

Read RFC 9588 on the RFC Editor

Outgoing relationships (12 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Normative reference — RFC 8126: Guidelines for Writing an IANA Considerations Section in RFCs
Normative reference — RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
Normative reference — RFC 4120: The Kerberos Network Authentication Service (V5)
Normative reference — RFC 7748: Elliptic Curves for Security
Normative reference — RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA)
Normative reference — RFC 3961: Encryption and Checksum Specifications for Kerberos 5
Normative reference — RFC 6113: A Generalized Framework for Kerberos Pre-Authentication
Informative reference — RFC 6090: Fundamental Elliptic Curve Cryptography Algorithms
Informative reference — RFC 8125: Requirements for Password-Authenticated Key Agreement (PAKE) Schemes
Informative reference — RFC 6560: One-Time Password (OTP) Pre-Authentication