Internet Assigned Numbers Authority • Domains • Protocols • Numbers • About Kerberos Parameters Created 2004-06-29 Last Updated 2024-12-06 Available Formats [IMG] XML [IMG] HTML [IMG] TXT Registries Included Below • Kerberos Encryption Type Numbers • Kerberos Checksum Type Numbers • Kerberos TCP Extensions • Pre-authentication and Typed Data • FAST Armor Types • FAST Options • Well-Known Kerberos Principal Names • Well-Known Kerberos Realm Names • Kerberos Message Transport Types • Kerberos Second Factor Types • Kerberos SPAKE Groups Kerberos Encryption Type Numbers Registration Procedure(s) Standards Action for standards-track RFCs; non-standards-track RFCs must be reviewed by an expert. Expert(s) Ken Raeburn Reference [RFC 3961] Note These are signed values ranging from -2147483648 to 2147483647. Positive values should be assigned only for algorithms specified in accordance with this specification for use with Kerberos or related protocols. Negative values are for private use; local and experimental algorithms should use these values. Zero is reserved and may not be assigned. Available Formats [IMG] CSV etype encryption type Reference 0 reserved [RFC 6448] 1 des-cbc-crc (deprecated) [RFC 6649] 2 des-cbc-md4 (deprecated) [RFC 6649] 3 des-cbc-md5 (deprecated) [RFC 6649] 4 Reserved [RFC 3961] 5 des3-cbc-md5 (deprecated) [RFC 8429] 6 Reserved [RFC 3961] 7 des3-cbc-sha1 (deprecated) [RFC 8429] 8 Unassigned 9 dsaWithSHA1-CmsOID [RFC 4556] 10 md5WithRSAEncryption-CmsOID [RFC 4556] 11 sha1WithRSAEncryption-CmsOID [RFC 4556] 12 rc2CBC-EnvOID [RFC 4556] 13 rsaEncryption-EnvOID [RFC 4556]; [from PKCS#1 v1.5]] 14 rsaES-OAEP-ENV-OID [RFC 4556]; [from PKCS#1 v2.0]] 15 des-ede3-cbc-Env-OID [RFC 4556] 16 des3-cbc-sha1-kd (deprecated) [RFC 8429] 17 aes128-cts-hmac-sha1-96 [RFC 3962] 18 aes256-cts-hmac-sha1-96 [RFC 3962] 19 aes128-cts-hmac-sha256-128 [RFC 8009] 20 aes256-cts-hmac-sha384-192 [RFC 8009] 21-22 Unassigned 23 rc4-hmac (deprecated) [RFC 8429] 24 rc4-hmac-exp (deprecated) [RFC 6649] 25 camellia128-cts-cmac [RFC 6803] 26 camellia256-cts-cmac [RFC 6803] 27-64 Unassigned 65 subkey-keymaterial [(opaque; PacketCable)] 66-2147483647 Unassigned Kerberos Checksum Type Numbers Registration Procedure(s) Standards Action for standards-track RFCs; non-standards-track RFCs must be reviewed by an expert. Expert(s) Ken Raeburn Reference [RFC 3961] Note These are signed values ranging from -2147483648 to 2147483647. Positive values should be assigned only for algorithms specified in accordance with this specification for use with Kerberos or related protocols. Negative values are for private use; local and experimental algorithms should use these values. Zero is reserved and may not be assigned. Available Formats [IMG] CSV sumtype value Checksum type checksum size Reference 0 Reserved [RFC 3961] 1 CRC32 (deprecated) 4 [RFC 6649] 2 rsa-md4 (deprecated) 16 [RFC 6649] 3 rsa-md4-des (deprecated) 24 [RFC 6649] 4 des-mac (deprecated) 16 [RFC 6649] 5 des-mac-k (deprecated) 8 [RFC 6649] 6 rsa-md4-des-k (deprecated) 16 [RFC 6649] 7 rsa-md5 (deprecated) 16 [RFC 8429] 8 rsa-md5-des (deprecated) 24 [RFC 6649] 9 rsa-md5-des3 24 10 sha1 (unkeyed) 20 11 Unassigned 12 hmac-sha1-des3-kd (deprecated) 20 [RFC 8429] 13 hmac-sha1-des3 (deprecated) 20 [RFC 8429] 14 sha1 (unkeyed) 20 15 hmac-sha1-96-aes128 20 [RFC 3962] 16 hmac-sha1-96-aes256 20 [RFC 3962] 17 cmac-camellia128 16 [RFC 6803] 18 cmac-camellia256 16 [RFC 6803] 19 hmac-sha256-128-aes128 16 [RFC 8009] 20 hmac-sha384-192-aes256 24 [RFC 8009] 21-32770 Unassigned 32771 Reserved [RFC 1964] 32772-2147483647 Unassigned Kerberos TCP Extensions Reference [RFC 5021] Available Formats [IMG] CSV Range Registration Procedures Note 0-29 Standards Action or IESG Approval 30 Reserved Standards Action that updates or obsoletes [RFC 5021] Value Description Reference 0 Krb5 over TLS [RFC 6251] 1-29 Unassigned 30 Reserved [RFC 5021] Pre-authentication and Typed Data Registration Procedure(s) Expert Review Expert(s) Sam Hartman (primary), Larry Zhu (secondary) Reference [RFC 6113] Note The designated expert may find that IETF Review is required. See [RFC 6113] for more information. Available Formats [IMG] CSV Type Value Reference 1 PA-TGS-REQ [RFC 4120] 2 PA-ENC-TIMESTAMP [RFC 4120] 3 PA-PW-SALT [RFC 4120] 4 reserved [RFC 6113] 5 PA-ENC-UNIX-TIME (deprecated) [RFC 4120] 6 PA-SANDIA-SECUREID [RFC 4120] 7 PA-SESAME [RFC 4120] 8 PA-OSF-DCE [RFC 4120] 9 PA-CYBERSAFE-SECUREID [RFC 4120] 10 PA-AFS3-SALT [RFC 4120]; [RFC 3961] 11 PA-ETYPE-INFO [RFC 4120] 12 PA-SAM-CHALLENGE [draft-ietf-cat-kerberos-passwords-04] 13 PA-SAM-RESPONSE [draft-ietf-cat-kerberos-passwords-04] 14 PA-PK-AS-REQ_OLD [draft-ietf-cat-kerberos-pk-init-09] 15 PA-PK-AS-REP_OLD [draft-ietf-cat-kerberos-pk-init-09] 16 PA-PK-AS-REQ [RFC 4556] 17 PA-PK-AS-REP [RFC 4556] 18 PA-PK-OCSP-RESPONSE [RFC 4557] 19 PA-ETYPE-INFO2 [RFC 4120] 20 PA-USE-SPECIFIED-KVNO [RFC 4120] 20 PA-SVR-REFERRAL-INFO [RFC 6806] 21 PA-SAM-REDIRECT [draft-ietf-krb-wg-kerberos-sam-03] 22 PA-GET-FROM-TYPED-DATA [(embedded in typed data)]; [RFC 4120] 22 TD-PADATA [(embeds padata)]; [RFC 4120] 23 PA-SAM-ETYPE-INFO [(sam/otp)]; [draft-ietf-krb-wg-kerberos-sam-03] 24 PA-ALT-PRINC [draft-ietf-krb-wg-hw-auth-04] 25 PA-SERVER-REFERRAL [draft-ietf-krb-wg-kerberos-referrals-11] 26-29 Unassigned 30 PA-SAM-CHALLENGE2 [draft-ietf-krb-wg-kerberos-sam-03] 31 PA-SAM-RESPONSE2 [draft-ietf-krb-wg-kerberos-sam-03] 32-40 Unassigned 41 PA-EXTRA-TGT [Reserved extra TGT]; [RFC 6113] 42-100 Unassigned 101 TD-PKINIT-CMS-CERTIFICATES [RFC 4556] 102 TD-KRB-PRINCIPAL [PrincipalName]; [RFC 6113] 103 TD-KRB-REALM [Realm]; [RFC 6113] 104 TD-TRUSTED-CERTIFIERS [RFC 4556] 105 TD-CERTIFICATE-INDEX [RFC 4556] 106 TD-APP-DEFINED-ERROR [Application specific]; [RFC 6113] 107 TD-REQ-NONCE [INTEGER]; [RFC 6113] 108 TD-REQ-SEQ [INTEGER]; [RFC 6113] 109 TD_DH_PARAMETERS [RFC 4556] 110 Unassigned 111 TD-CMS-DIGEST-ALGORITHMS [RFC 8636] 112 TD-CERT-DIGEST-ALGORITHMS [RFC 8636] 113-127 Unassigned 128 PA-PAC-REQUEST [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 129 PA-FOR_USER [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 130 PA-FOR-X509-USER [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 131 PA-FOR-CHECK_DUPS [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 132 PA-AS-CHECKSUM [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 133 PA-FX-COOKIE [RFC 6113] 134 PA-AUTHENTICATION-SET [RFC 6113] 135 PA-AUTH-SET-SELECTED [RFC 6113] 136 PA-FX-FAST [RFC 6113] 137 PA-FX-ERROR [RFC 6113] 138 PA-ENCRYPTED-CHALLENGE [RFC 6113] 139-140 Unassigned 141 PA-OTP-CHALLENGE [RFC 6560] 142 PA-OTP-REQUEST [RFC 6560] 143 PA-OTP-CONFIRM (OBSOLETED) [RFC 6560] 144 PA-OTP-PIN-CHANGE [RFC 6560] 145 PA-EPAK-AS-REQ [(sshock@gmail.com)]; [RFC 6113] 146 PA-EPAK-AS-REP [(sshock@gmail.com)]; [RFC 6113] 147 PA_PKINIT_KX [RFC 8062] 148 PA_PKU2U_NAME [draft-zhu-pku2u-09] 149 PA-REQ-ENC-PA-REP [RFC 6806] 150 PA_AS_FRESHNESS [RFC 8070] 151 PA-SPAKE [RFC 9588] 152 PA-REDHAT-IDP-OAUTH2 [Pavel_Březina] 153 PA-REDHAT-PASSKEY [Pavel_Březina] 154-164 Unassigned 165 PA-SUPPORTED-ETYPES [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] 166 PA-EXTENDED_ERROR [MSKILE]; [http://msdn2.microsoft.com/en-us/library/cc206927.aspx] FAST Armor Types Registration Procedure(s) Standards Action Reference [RFC 6113] Available Formats [IMG] CSV Type Name Description Reference 0 Reserved Reserved [RFC 6113] 1 FX_FAST_ARMOR_AP_REQUEST Ticket armor using an ap-req. [RFC 6113] FAST Options Registration Procedure(s) Standards Action Reference [RFC 6113] Available Formats [IMG] CSV Type Name Description Reference 0 RESERVED Reserved for future expansion of this field. [RFC 6113] 1 hide-client-names Requesting the KDC to hide client names in the KDC response [RFC 6113] 16 kdc-follow-referrals reserved [RFC 6113] Well-Known Kerberos Principal Names Registration Procedure(s) Specification Required Expert(s) Unassigned Reference [RFC 6111] Available Formats [IMG] CSV Well-Known Kerberos Principal Name Reference anonymous [RFC 8062] Well-Known Kerberos Realm Names Registration Procedure(s) Specification Required Expert(s) Unassigned Reference [RFC 6111] Available Formats [IMG] CSV Well-Known Kerberos Realm Name Reference anonymous [RFC 8062] Kerberos Message Transport Types Registration Procedure(s) IETF Review Reference [RFC 6784] Available Formats [IMG] CSV Value Description Reference 0 Reserved [RFC 6784] 1 UDP [RFC 6784] 2 TCP [RFC 6784] 3 TLS [RFC 6784] 4-254 Unassigned 255 Reserved [RFC 6784] Kerberos Second Factor Types Registration Procedure(s) Specification Required Expert(s) Simo Sorce, Greg Hudson Reference [RFC 9588] Note Registration requests should be sent to the mailing list described in [RFC 9588]. If approved, designated experts should notify IANA within three weeks. For assistance, please contact iana@iana.org. Note These are signed integers ranging from -2147483648 to 2147483647, inclusive. Positive values must be assigned only for algorithms specified in accordance with these rules for use with Kerberos and related protocols. Negative values should be used for private and experimental algorithms only. Zero is reserved and must not be assigned. Values should be assigned in increasing order. Available Formats [IMG] CSV ID Number Name Reference 0 Reserved [RFC 9588] 1 SF-NONE [RFC 9588] Kerberos SPAKE Groups Registration Procedure(s) Specification Required Expert(s) Simo Sorce, Greg Hudson Reference [RFC 9588] Note Registration requests should be sent to the mailing list described in [RFC 9588]. If approved, designated experts should notify IANA within three weeks. For assistance, please contact iana@iana.org. Note These are signed integers ranging from -2147483648 to 2147483647, inclusive. Positive values must be assigned only for algorithms specified in accordance with these rules for use with Kerberos and related protocols. Negative values should be used for private and experimental algorithms only. Zero is reserved and must not be assigned. Values should be assigned in increasing order. Available Formats [IMG] CSV ID Name Serialization Multiplier Multiplier SPAKE M Constant SPAKE N Constant Hash Reference Number Length Conversion Function 0 Reserved [RFC 9588] [RFC 8032, [RFC 8032, SHA-256 [RFC 7748, 1 edwards25519 Section 3.1] 32 Section d048032c6ea0b6d697ddc2e86bda85a33adac920f1bf18e1b0c6d166a5cecdaf d3bfb518f44f3430f29d0c92af503865a1ed3281dc69b35dd868ba85f886c4ab [RFC Section 4.1]; 3.1] 6234] [(edwards25519)] [SECG-SEC1, Section [SECG-SEC1, SHA-256 [SECG-SEC2, 2 P-256 2.3.3]; 32 Section 02886e2f97ace46e55ba9dd7242579f2993b64e16ef3dcab95afd497333d8fa12f 03d8bbd6c639c62937b04d997f38c3770719c629d7014d49a24b4f98baa1292b49 [RFC Section 2.4.2] [(compressed 2.3.8] 6234] format)] [SECG-SEC1, Section [SECG-SEC1, SHA-384 [SECG-SEC2, 3 P-384 2.3.3]; 48 Section 030ff0895ae5ebf6187080a82d82b42e2765e3b2f8749c7e05eba366434b363d3dc36f15314739074d2eb8613fceec2853 02c72cf2e390853a1c1c4ad816a62fd15824f56078918f43f922ca21518f9c543bb252c5490214cf9aa3f0baab4b665c10 [RFC Section 2.5.1] [(compressed 2.3.8] 6234] format)] [SECG-SEC1, Section [SECG-SEC1, SHA-512 [SECG-SEC2, 4 P-521 2.3.3]; 48 Section 02003f06f38131b2ba2600791e82488e8d20ab889af753a41806c5db18d37d85608cfae06b82e4a72cd744c719193562a653ea1f119eef9356907edc9b56979962d7aa 0200c7924b9ec017f3094562894336a53c50167ba8c5963876880542bc669e494b2532d76c5b53dfb349fdf69154b9e0048c58a42e8ed04cef052a3bc349d95575cd25 [RFC Section 2.6.1] [(compressed 2.3.8] 6234] format)] Contact Information ID Name Contact URI Last Updated [Pavel_Březina] Pavel Březina mailto:pbrezina&redhat.com 2023-03-29 Licensing Terms