source4/heimdal/lib/asn1/k5.asn1

   1 -- $Id$
   2
   3 KERBEROS5 DEFINITIONS ::=
   4 BEGIN
   5
   6 NAME-TYPE ::= INTEGER {
   7         KRB5_NT_UNKNOWN(0),     -- Name type not known
   8         KRB5_NT_PRINCIPAL(1),   -- Just the name of the principal as in
   9         KRB5_NT_SRV_INST(2),    -- Service and other unique instance (krbtgt)
  10         KRB5_NT_SRV_HST(3),     -- Service with host name as instance
  11         KRB5_NT_SRV_XHST(4),    -- Service with host as remaining components
  12         KRB5_NT_UID(5),         -- Unique ID
  13         KRB5_NT_X500_PRINCIPAL(6), -- PKINIT
  14         KRB5_NT_SMTP_NAME(7),   -- Name in form of SMTP email name
  15         KRB5_NT_ENTERPRISE_PRINCIPAL(10), -- Windows 2000 UPN
  16         KRB5_NT_ENT_PRINCIPAL_AND_ID(-130), -- Windows 2000 UPN and SID
  17         KRB5_NT_MS_PRINCIPAL(-128), -- NT 4 style name
  18         KRB5_NT_MS_PRINCIPAL_AND_ID(-129) -- NT style name and SID
  19 }
  20
  21 -- message types
  22
  23 MESSAGE-TYPE ::= INTEGER {
  24         krb-as-req(10), -- Request for initial authentication
  25         krb-as-rep(11), -- Response to KRB_AS_REQ request
  26         krb-tgs-req(12), -- Request for authentication based on TGT
  27         krb-tgs-rep(13), -- Response to KRB_TGS_REQ request
  28         krb-ap-req(14), -- application request to server
  29         krb-ap-rep(15), -- Response to KRB_AP_REQ_MUTUAL
  30         krb-safe(20), -- Safe (checksummed) application message
  31         krb-priv(21), -- Private (encrypted) application message
  32         krb-cred(22), -- Private (encrypted) message to forward credentials
  33         krb-error(30) -- Error response
  34 }
  35
  36
  37 -- pa-data types
  38
  39 PADATA-TYPE ::= INTEGER {
  40         KRB5-PADATA-NONE(0),
  41         KRB5-PADATA-TGS-REQ(1),
  42         KRB5-PADATA-AP-REQ(1),
  43         KRB5-PADATA-ENC-TIMESTAMP(2),
  44         KRB5-PADATA-PW-SALT(3),
  45         KRB5-PADATA-ENC-UNIX-TIME(5),
  46         KRB5-PADATA-SANDIA-SECUREID(6),
  47         KRB5-PADATA-SESAME(7),
  48         KRB5-PADATA-OSF-DCE(8),
  49         KRB5-PADATA-CYBERSAFE-SECUREID(9),
  50         KRB5-PADATA-AFS3-SALT(10),
  51         KRB5-PADATA-ETYPE-INFO(11),
  52         KRB5-PADATA-SAM-CHALLENGE(12), -- (sam/otp)
  53         KRB5-PADATA-SAM-RESPONSE(13), -- (sam/otp)
  54         KRB5-PADATA-PK-AS-REQ-19(14), -- (PKINIT-19)
  55         KRB5-PADATA-PK-AS-REP-19(15), -- (PKINIT-19)
  56         KRB5-PADATA-PK-AS-REQ-WIN(15), -- (PKINIT - old number)
  57         KRB5-PADATA-PK-AS-REQ(16), -- (PKINIT-25)
  58         KRB5-PADATA-PK-AS-REP(17), -- (PKINIT-25)
  59         KRB5-PADATA-PA-PK-OCSP-RESPONSE(18),
  60         KRB5-PADATA-ETYPE-INFO2(19),
  61         KRB5-PADATA-USE-SPECIFIED-KVNO(20),
  62         KRB5-PADATA-SVR-REFERRAL-INFO(20), --- old ms referral number
  63         KRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp)
  64         KRB5-PADATA-GET-FROM-TYPED-DATA(22),
  65         KRB5-PADATA-SAM-ETYPE-INFO(23),
  66         KRB5-PADATA-SERVER-REFERRAL(25),
  67         KRB5-PADATA-TD-KRB-PRINCIPAL(102),      -- PrincipalName
  68         KRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS(104), -- PKINIT
  69         KRB5-PADATA-PK-TD-CERTIFICATE-INDEX(105), -- PKINIT
  70         KRB5-PADATA-TD-APP-DEFINED-ERROR(106),  -- application specific
  71         KRB5-PADATA-TD-REQ-NONCE(107),          -- INTEGER
  72         KRB5-PADATA-TD-REQ-SEQ(108),            -- INTEGER
  73         KRB5-PADATA-PA-PAC-REQUEST(128),        -- jbrezak@exchange.microsoft.com
  74         KRB5-PADATA-S4U2SELF(129),
  75         KRB5-PADATA-EPAC(130),                  -- EPAK
  76         KRB5-PADATA-PK-AS-09-BINDING(132),      -- client send this to
  77                                                 -- tell KDC that is supports
  78                                                 -- the asCheckSum in the
  79                                                 --  PK-AS-REP
  80         KRB5-PADATA-CLIENT-CANONICALIZED(133)   --
  81 }
  82
  83 AUTHDATA-TYPE ::= INTEGER {
  84         KRB5-AUTHDATA-IF-RELEVANT(1),
  85         KRB5-AUTHDATA-INTENDED-FOR_SERVER(2),
  86         KRB5-AUTHDATA-INTENDED-FOR-APPLICATION-CLASS(3),
  87         KRB5-AUTHDATA-KDC-ISSUED(4),
  88         KRB5-AUTHDATA-AND-OR(5),
  89         KRB5-AUTHDATA-MANDATORY-TICKET-EXTENSIONS(6),
  90         KRB5-AUTHDATA-IN-TICKET-EXTENSIONS(7),
  91         KRB5-AUTHDATA-MANDATORY-FOR-KDC(8),
  92         KRB5-AUTHDATA-INITIAL-VERIFIED-CAS(9),
  93         KRB5-AUTHDATA-OSF-DCE(64),
  94         KRB5-AUTHDATA-SESAME(65),
  95         KRB5-AUTHDATA-OSF-DCE-PKI-CERTID(66),
  96         KRB5-AUTHDATA-WIN2K-PAC(128),
  97         KRB5-AUTHDATA-GSS-API-ETYPE-NEGOTIATION(129), -- Authenticator only
  98         KRB5-AUTHDATA-SIGNTICKET-OLD(-17),
  99         KRB5-AUTHDATA-SIGNTICKET(142)
 100 }
 101
 102 -- checksumtypes
 103
 104 CKSUMTYPE ::= INTEGER {
 105         CKSUMTYPE_NONE(0),
 106         CKSUMTYPE_CRC32(1),
 107         CKSUMTYPE_RSA_MD4(2),
 108         CKSUMTYPE_RSA_MD4_DES(3),
 109         CKSUMTYPE_DES_MAC(4),
 110         CKSUMTYPE_DES_MAC_K(5),
 111         CKSUMTYPE_RSA_MD4_DES_K(6),
 112         CKSUMTYPE_RSA_MD5(7),
 113         CKSUMTYPE_RSA_MD5_DES(8),
 114         CKSUMTYPE_RSA_MD5_DES3(9),
 115         CKSUMTYPE_SHA1_OTHER(10),
 116         CKSUMTYPE_HMAC_SHA1_DES3(12),
 117         CKSUMTYPE_SHA1(14),
 118         CKSUMTYPE_HMAC_SHA1_96_AES_128(15),
 119         CKSUMTYPE_HMAC_SHA1_96_AES_256(16),
 120         CKSUMTYPE_GSSAPI(0x8003),
 121         CKSUMTYPE_HMAC_MD5(-138),       -- unofficial microsoft number
 122         CKSUMTYPE_HMAC_MD5_ENC(-1138)   -- even more unofficial
 123 }
 124
 125 --enctypes
 126 ENCTYPE ::= INTEGER {
 127         ETYPE_NULL(0),
 128         ETYPE_DES_CBC_CRC(1),
 129         ETYPE_DES_CBC_MD4(2),
 130         ETYPE_DES_CBC_MD5(3),
 131         ETYPE_DES3_CBC_MD5(5),
 132         ETYPE_OLD_DES3_CBC_SHA1(7),
 133         ETYPE_SIGN_DSA_GENERATE(8),
 134         ETYPE_ENCRYPT_RSA_PRIV(9),
 135         ETYPE_ENCRYPT_RSA_PUB(10),
 136         ETYPE_DES3_CBC_SHA1(16),        -- with key derivation
 137         ETYPE_AES128_CTS_HMAC_SHA1_96(17),
 138         ETYPE_AES256_CTS_HMAC_SHA1_96(18),
 139         ETYPE_ARCFOUR_HMAC_MD5(23),
 140         ETYPE_ARCFOUR_HMAC_MD5_56(24),
 141         ETYPE_ENCTYPE_PK_CROSS(48),
 142 -- some "old" windows types
 143         ETYPE_ARCFOUR_MD4(-128),
 144         ETYPE_ARCFOUR_HMAC_OLD(-133),
 145         ETYPE_ARCFOUR_HMAC_OLD_EXP(-135),
 146 -- these are for Heimdal internal use
 147         ETYPE_DES_CBC_NONE(-0x1000),
 148         ETYPE_DES3_CBC_NONE(-0x1001),
 149         ETYPE_DES_CFB64_NONE(-0x1002),
 150         ETYPE_DES_PCBC_NONE(-0x1003),
 151         ETYPE_DIGEST_MD5_NONE(-0x1004),         -- private use, lukeh@padl.com
 152         ETYPE_CRAM_MD5_NONE(-0x1005)            -- private use, lukeh@padl.com
 153 }
 154
 155
 156
 157
 158 -- this is sugar to make something ASN1 does not have: unsigned
 159
 160 krb5uint32 ::= INTEGER (0..4294967295)
 161 krb5int32 ::= INTEGER (-2147483648..2147483647)
 162
 163 KerberosString  ::= GeneralString
 164
 165 Realm ::= GeneralString
 166 PrincipalName ::= SEQUENCE {
 167         name-type[0]            NAME-TYPE,
 168         name-string[1]          SEQUENCE OF GeneralString
 169 }
 170
 171 -- this is not part of RFC1510
 172 Principal ::= SEQUENCE {
 173         name[0]                 PrincipalName,
 174         realm[1]                Realm
 175 }
 176
 177 HostAddress ::= SEQUENCE  {
 178         addr-type[0]            krb5int32,
 179         address[1]              OCTET STRING
 180 }
 181
 182 -- This is from RFC1510.
 183 --
 184 -- HostAddresses ::= SEQUENCE OF SEQUENCE {
 185 --      addr-type[0]            krb5int32,
 186 --      address[1]              OCTET STRING
 187 -- }
 188
 189 -- This seems much better.
 190 HostAddresses ::= SEQUENCE OF HostAddress
 191
 192
 193 KerberosTime ::= GeneralizedTime -- Specifying UTC time zone (Z)
 194
 195 AuthorizationDataElement ::= SEQUENCE {
 196         ad-type[0]              krb5int32,
 197         ad-data[1]              OCTET STRING
 198 }
 199
 200 AuthorizationData ::= SEQUENCE OF AuthorizationDataElement
 201
 202 APOptions ::= BIT STRING {
 203         reserved(0),
 204         use-session-key(1),
 205         mutual-required(2)
 206 }
 207
 208 TicketFlags ::= BIT STRING {
 209         reserved(0),
 210         forwardable(1),
 211         forwarded(2),
 212         proxiable(3),
 213         proxy(4),
 214         may-postdate(5),
 215         postdated(6),
 216         invalid(7),
 217         renewable(8),
 218         initial(9),
 219         pre-authent(10),
 220         hw-authent(11),
 221         transited-policy-checked(12),
 222         ok-as-delegate(13),
 223         anonymous(14)
 224 }
 225
 226 KDCOptions ::= BIT STRING {
 227         reserved(0),
 228         forwardable(1),
 229         forwarded(2),
 230         proxiable(3),
 231         proxy(4),
 232         allow-postdate(5),
 233         postdated(6),
 234         unused7(7),
 235         renewable(8),
 236         unused9(9),
 237         unused10(10),
 238         unused11(11),
 239         request-anonymous(14),
 240         canonicalize(15),
 241         constrained-delegation(16), -- ms extension
 242         disable-transited-check(26),
 243         renewable-ok(27),
 244         enc-tkt-in-skey(28),
 245         renew(30),
 246         validate(31)
 247 }
 248
 249 LR-TYPE ::= INTEGER {
 250         LR_NONE(0),             -- no information
 251         LR_INITIAL_TGT(1),      -- last initial TGT request
 252         LR_INITIAL(2),          -- last initial request
 253         LR_ISSUE_USE_TGT(3),    -- time of newest TGT used
 254         LR_RENEWAL(4),          -- time of last renewal
 255         LR_REQUEST(5),          -- time of last request (of any type)
 256         LR_PW_EXPTIME(6),       -- expiration time of password
 257         LR_ACCT_EXPTIME(7)      -- expiration time of account
 258 }
 259
 260 LastReq ::= SEQUENCE OF SEQUENCE {
 261         lr-type[0]              LR-TYPE,
 262         lr-value[1]             KerberosTime
 263 }
 264
 265
 266 EncryptedData ::= SEQUENCE {
 267         etype[0]                ENCTYPE, -- EncryptionType
 268         kvno[1]                 krb5int32 OPTIONAL,
 269         cipher[2]               OCTET STRING -- ciphertext
 270 }
 271
 272 EncryptionKey ::= SEQUENCE {
 273         keytype[0]              krb5int32,
 274         keyvalue[1]             OCTET STRING
 275 }
 276
 277 -- encoded Transited field
 278 TransitedEncoding ::= SEQUENCE {
 279         tr-type[0]              krb5int32, -- must be registered
 280         contents[1]             OCTET STRING
 281 }
 282
 283 Ticket ::= [APPLICATION 1] SEQUENCE {
 284         tkt-vno[0]              krb5int32,
 285         realm[1]                Realm,
 286         sname[2]                PrincipalName,
 287         enc-part[3]             EncryptedData
 288 }
 289 -- Encrypted part of ticket
 290 EncTicketPart ::= [APPLICATION 3] SEQUENCE {
 291         flags[0]                TicketFlags,
 292         key[1]                  EncryptionKey,
 293         crealm[2]               Realm,
 294         cname[3]                PrincipalName,
 295         transited[4]            TransitedEncoding,
 296         authtime[5]             KerberosTime,
 297         starttime[6]            KerberosTime OPTIONAL,
 298         endtime[7]              KerberosTime,
 299         renew-till[8]           KerberosTime OPTIONAL,
 300         caddr[9]                HostAddresses OPTIONAL,
 301         authorization-data[10]  AuthorizationData OPTIONAL
 302 }
 303
 304 Checksum ::= SEQUENCE {
 305         cksumtype[0]            CKSUMTYPE,
 306         checksum[1]             OCTET STRING
 307 }
 308
 309 Authenticator ::= [APPLICATION 2] SEQUENCE    {
 310         authenticator-vno[0]    krb5int32,
 311         crealm[1]               Realm,
 312         cname[2]                PrincipalName,
 313         cksum[3]                Checksum OPTIONAL,
 314         cusec[4]                krb5int32,
 315         ctime[5]                KerberosTime,
 316         subkey[6]               EncryptionKey OPTIONAL,
 317         seq-number[7]           krb5uint32 OPTIONAL,
 318         authorization-data[8]   AuthorizationData OPTIONAL
 319 }
 320
 321 PA-DATA ::= SEQUENCE {
 322         -- might be encoded AP-REQ
 323         padata-type[1]          PADATA-TYPE,
 324         padata-value[2]         OCTET STRING
 325 }
 326
 327 ETYPE-INFO-ENTRY ::= SEQUENCE {
 328         etype[0]                ENCTYPE,
 329         salt[1]                 OCTET STRING OPTIONAL,
 330         salttype[2]             krb5int32 OPTIONAL
 331 }
 332
 333 ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY
 334
 335 ETYPE-INFO2-ENTRY ::= SEQUENCE {
 336         etype[0]                ENCTYPE,
 337         salt[1]                 KerberosString OPTIONAL,
 338         s2kparams[2]            OCTET STRING OPTIONAL
 339 }
 340
 341 ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY
 342
 343 METHOD-DATA ::= SEQUENCE OF PA-DATA
 344
 345 TypedData ::=   SEQUENCE {
 346         data-type[0]            krb5int32,
 347         data-value[1]           OCTET STRING OPTIONAL
 348 }
 349
 350 TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF TypedData
 351
 352 KDC-REQ-BODY ::= SEQUENCE {
 353         kdc-options[0]          KDCOptions,
 354         cname[1]                PrincipalName OPTIONAL, -- Used only in AS-REQ
 355         realm[2]                Realm,  -- Server's realm
 356                                         -- Also client's in AS-REQ
 357         sname[3]                PrincipalName OPTIONAL,
 358         from[4]                 KerberosTime OPTIONAL,
 359         till[5]                 KerberosTime OPTIONAL,
 360         rtime[6]                KerberosTime OPTIONAL,
 361         nonce[7]                krb5int32,
 362         etype[8]                SEQUENCE OF ENCTYPE, -- EncryptionType,
 363                                         -- in preference order
 364         addresses[9]            HostAddresses OPTIONAL,
 365         enc-authorization-data[10] EncryptedData OPTIONAL,
 366                                         -- Encrypted AuthorizationData encoding
 367         additional-tickets[11]  SEQUENCE OF Ticket OPTIONAL
 368 }
 369
 370 KDC-REQ ::= SEQUENCE {
 371         pvno[1]                 krb5int32,
 372         msg-type[2]             MESSAGE-TYPE,
 373         padata[3]               METHOD-DATA OPTIONAL,
 374         req-body[4]             KDC-REQ-BODY
 375 }
 376
 377 AS-REQ ::= [APPLICATION 10] KDC-REQ
 378 TGS-REQ ::= [APPLICATION 12] KDC-REQ
 379
 380 -- padata-type ::= PA-ENC-TIMESTAMP
 381 -- padata-value ::= EncryptedData - PA-ENC-TS-ENC
 382
 383 PA-ENC-TS-ENC ::= SEQUENCE {
 384         patimestamp[0]          KerberosTime, -- client's time
 385         pausec[1]               krb5int32 OPTIONAL
 386 }
 387
 388 -- draft-brezak-win2k-krb-authz-01
 389 PA-PAC-REQUEST ::= SEQUENCE {
 390         include-pac[0]          BOOLEAN -- Indicates whether a PAC
 391                                         -- should be included or not
 392 }
 393
 394 -- PacketCable provisioning server location, PKT-SP-SEC-I09-030728.pdf
 395 PROV-SRV-LOCATION ::= GeneralString
 396
 397 KDC-REP ::= SEQUENCE {
 398         pvno[0]                 krb5int32,
 399         msg-type[1]             MESSAGE-TYPE,
 400         padata[2]               METHOD-DATA OPTIONAL,
 401         crealm[3]               Realm,
 402         cname[4]                PrincipalName,
 403         ticket[5]               Ticket,
 404         enc-part[6]             EncryptedData
 405 }
 406
 407 AS-REP ::= [APPLICATION 11] KDC-REP
 408 TGS-REP ::= [APPLICATION 13] KDC-REP
 409
 410 EncKDCRepPart ::= SEQUENCE {
 411         key[0]                  EncryptionKey,
 412         last-req[1]             LastReq,
 413         nonce[2]                krb5int32,
 414         key-expiration[3]       KerberosTime OPTIONAL,
 415         flags[4]                TicketFlags,
 416         authtime[5]             KerberosTime,
 417         starttime[6]            KerberosTime OPTIONAL,
 418         endtime[7]              KerberosTime,
 419         renew-till[8]           KerberosTime OPTIONAL,
 420         srealm[9]               Realm,
 421         sname[10]               PrincipalName,
 422         caddr[11]               HostAddresses OPTIONAL,
 423         encrypted-pa-data[12]   METHOD-DATA OPTIONAL
 424 }
 425
 426 EncASRepPart ::= [APPLICATION 25] EncKDCRepPart
 427 EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart
 428
 429 AP-REQ ::= [APPLICATION 14] SEQUENCE {
 430         pvno[0]                 krb5int32,
 431         msg-type[1]             MESSAGE-TYPE,
 432         ap-options[2]           APOptions,
 433         ticket[3]               Ticket,
 434         authenticator[4]        EncryptedData
 435 }
 436
 437 AP-REP ::= [APPLICATION 15] SEQUENCE {
 438         pvno[0]                 krb5int32,
 439         msg-type[1]             MESSAGE-TYPE,
 440         enc-part[2]             EncryptedData
 441 }
 442
 443 EncAPRepPart ::= [APPLICATION 27]     SEQUENCE {
 444         ctime[0]                KerberosTime,
 445         cusec[1]                krb5int32,
 446         subkey[2]               EncryptionKey OPTIONAL,
 447         seq-number[3]           krb5uint32 OPTIONAL
 448 }
 449
 450 KRB-SAFE-BODY ::= SEQUENCE {
 451         user-data[0]            OCTET STRING,
 452         timestamp[1]            KerberosTime OPTIONAL,
 453         usec[2]                 krb5int32 OPTIONAL,
 454         seq-number[3]           krb5uint32 OPTIONAL,
 455         s-address[4]            HostAddress OPTIONAL,
 456         r-address[5]            HostAddress OPTIONAL
 457 }
 458
 459 KRB-SAFE ::= [APPLICATION 20] SEQUENCE {
 460         pvno[0]                 krb5int32,
 461         msg-type[1]             MESSAGE-TYPE,
 462         safe-body[2]            KRB-SAFE-BODY,
 463         cksum[3]                Checksum
 464 }
 465
 466 KRB-PRIV ::= [APPLICATION 21] SEQUENCE {
 467         pvno[0]                 krb5int32,
 468         msg-type[1]             MESSAGE-TYPE,
 469         enc-part[3]             EncryptedData
 470 }
 471 EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE {
 472         user-data[0]            OCTET STRING,
 473         timestamp[1]            KerberosTime OPTIONAL,
 474         usec[2]                 krb5int32 OPTIONAL,
 475         seq-number[3]           krb5uint32 OPTIONAL,
 476         s-address[4]            HostAddress OPTIONAL, -- sender's addr
 477         r-address[5]            HostAddress OPTIONAL  -- recip's addr
 478 }
 479
 480 KRB-CRED ::= [APPLICATION 22]   SEQUENCE {
 481         pvno[0]                 krb5int32,
 482         msg-type[1]             MESSAGE-TYPE, -- KRB_CRED
 483         tickets[2]              SEQUENCE OF Ticket,
 484         enc-part[3]             EncryptedData
 485 }
 486
 487 KrbCredInfo ::= SEQUENCE {
 488         key[0]                  EncryptionKey,
 489         prealm[1]               Realm OPTIONAL,
 490         pname[2]                PrincipalName OPTIONAL,
 491         flags[3]                TicketFlags OPTIONAL,
 492         authtime[4]             KerberosTime OPTIONAL,
 493         starttime[5]            KerberosTime OPTIONAL,
 494         endtime[6]              KerberosTime OPTIONAL,
 495         renew-till[7]           KerberosTime OPTIONAL,
 496         srealm[8]               Realm OPTIONAL,
 497         sname[9]                PrincipalName OPTIONAL,
 498         caddr[10]               HostAddresses OPTIONAL
 499 }
 500
 501 EncKrbCredPart ::= [APPLICATION 29]   SEQUENCE {
 502         ticket-info[0]          SEQUENCE OF KrbCredInfo,
 503         nonce[1]                krb5int32 OPTIONAL,
 504         timestamp[2]            KerberosTime OPTIONAL,
 505         usec[3]                 krb5int32 OPTIONAL,
 506         s-address[4]            HostAddress OPTIONAL,
 507         r-address[5]            HostAddress OPTIONAL
 508 }
 509
 510 KRB-ERROR ::= [APPLICATION 30] SEQUENCE {
 511         pvno[0]                 krb5int32,
 512         msg-type[1]             MESSAGE-TYPE,
 513         ctime[2]                KerberosTime OPTIONAL,
 514         cusec[3]                krb5int32 OPTIONAL,
 515         stime[4]                KerberosTime,
 516         susec[5]                krb5int32,
 517         error-code[6]           krb5int32,
 518         crealm[7]               Realm OPTIONAL,
 519         cname[8]                PrincipalName OPTIONAL,
 520         realm[9]                Realm, -- Correct realm
 521         sname[10]               PrincipalName, -- Correct name
 522         e-text[11]              GeneralString OPTIONAL,
 523         e-data[12]              OCTET STRING OPTIONAL
 524 }
 525
 526 ChangePasswdDataMS ::= SEQUENCE {
 527         newpasswd[0]            OCTET STRING,
 528         targname[1]             PrincipalName OPTIONAL,
 529         targrealm[2]            Realm OPTIONAL
 530 }
 531
 532 EtypeList ::= SEQUENCE OF krb5int32
 533         -- the client's proposed enctype list in
 534         -- decreasing preference order, favorite choice first
 535
 536 krb5-pvno krb5int32 ::= 5 -- current Kerberos protocol version number
 537
 538 -- transited encodings
 539
 540 DOMAIN-X500-COMPRESS    krb5int32 ::= 1
 541
 542 -- authorization data primitives
 543
 544 AD-IF-RELEVANT ::= AuthorizationData
 545
 546 AD-KDCIssued ::= SEQUENCE {
 547         ad-checksum[0]          Checksum,
 548         i-realm[1]              Realm OPTIONAL,
 549         i-sname[2]              PrincipalName OPTIONAL,
 550         elements[3]             AuthorizationData
 551 }
 552
 553 AD-AND-OR ::= SEQUENCE {
 554         condition-count[0]      INTEGER,
 555         elements[1]             AuthorizationData
 556 }
 557
 558 AD-MANDATORY-FOR-KDC ::= AuthorizationData
 559
 560 -- PA-SAM-RESPONSE-2/PA-SAM-RESPONSE-2
 561
 562 PA-SAM-TYPE ::= INTEGER {
 563         PA_SAM_TYPE_ENIGMA(1),          -- Enigma Logic
 564         PA_SAM_TYPE_DIGI_PATH(2),       -- Digital Pathways
 565         PA_SAM_TYPE_SKEY_K0(3),         -- S/key where  KDC has key 0
 566         PA_SAM_TYPE_SKEY(4),            -- Traditional S/Key
 567         PA_SAM_TYPE_SECURID(5),         -- Security Dynamics
 568         PA_SAM_TYPE_CRYPTOCARD(6)       -- CRYPTOCard
 569 }
 570
 571 PA-SAM-REDIRECT ::= HostAddresses
 572
 573 SAMFlags ::= BIT STRING {
 574         use-sad-as-key(0),
 575         send-encrypted-sad(1),
 576         must-pk-encrypt-sad(2)
 577 }
 578
 579 PA-SAM-CHALLENGE-2-BODY ::= SEQUENCE {
 580         sam-type[0]             krb5int32,
 581         sam-flags[1]            SAMFlags,
 582         sam-type-name[2]        GeneralString OPTIONAL,
 583         sam-track-id[3]         GeneralString OPTIONAL,
 584         sam-challenge-label[4]  GeneralString OPTIONAL,
 585         sam-challenge[5]        GeneralString OPTIONAL,
 586         sam-response-prompt[6]  GeneralString OPTIONAL,
 587         sam-pk-for-sad[7]       EncryptionKey OPTIONAL,
 588         sam-nonce[8]            krb5int32,
 589         sam-etype[9]            krb5int32,
 590         ...
 591 }
 592
 593 PA-SAM-CHALLENGE-2 ::= SEQUENCE {
 594         sam-body[0]             PA-SAM-CHALLENGE-2-BODY,
 595         sam-cksum[1]            SEQUENCE OF Checksum, -- (1..MAX)
 596         ...
 597 }
 598
 599 PA-SAM-RESPONSE-2 ::= SEQUENCE {
 600         sam-type[0]             krb5int32,
 601         sam-flags[1]            SAMFlags,
 602         sam-track-id[2]         GeneralString OPTIONAL,
 603         sam-enc-nonce-or-sad[3] EncryptedData, -- PA-ENC-SAM-RESPONSE-ENC
 604         sam-nonce[4]            krb5int32,
 605         ...
 606 }
 607
 608 PA-ENC-SAM-RESPONSE-ENC ::= SEQUENCE {
 609         sam-nonce[0]            krb5int32,
 610         sam-sad[1]              GeneralString OPTIONAL,
 611         ...
 612 }
 613
 614 PA-S4U2Self ::= SEQUENCE {
 615         name[0]         PrincipalName,
 616         realm[1]        Realm,
 617         cksum[2]        Checksum,
 618         auth[3]         GeneralString
 619 }
 620
 621 KRB5SignedPathPrincipals ::= SEQUENCE OF Principal
 622
 623 -- never encoded on the wire, just used to checksum over
 624 KRB5SignedPathData ::= SEQUENCE {
 625         encticket[0]    EncTicketPart,
 626         delegated[1]    KRB5SignedPathPrincipals OPTIONAL
 627 }
 628
 629 KRB5SignedPath ::= SEQUENCE {
 630         -- DERcoded KRB5SignedPathData
 631         -- krbtgt key (etype), KeyUsage = XXX
 632         etype[0]        ENCTYPE,
 633         cksum[1]        Checksum,
 634         -- srvs delegated though
 635         delegated[2]    KRB5SignedPathPrincipals OPTIONAL
 636 }
 637
 638 PA-ClientCanonicalizedNames ::= SEQUENCE{
 639         requested-name  [0] PrincipalName,
 640         mapped-name     [1] PrincipalName
 641 }
 642
 643 PA-ClientCanonicalized ::= SEQUENCE {
 644         names           [0] PA-ClientCanonicalizedNames,
 645         canon-checksum  [1] Checksum
 646 }
 647
 648 AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD --
 649         login-alias     [0] PrincipalName,
 650         checksum        [1] Checksum
 651 }
 652
 653 -- old ms referral
 654 PA-SvrReferralData ::= SEQUENCE {
 655         referred-name   [1] PrincipalName OPTIONAL,
 656         referred-realm  [0] Realm
 657 }
 658
 659 PA-SERVER-REFERRAL-DATA ::= EncryptedData
 660
 661 PA-ServerReferralData ::= SEQUENCE {
 662         referred-realm          [0] Realm OPTIONAL,
 663         true-principal-name     [1] PrincipalName OPTIONAL,
 664         requested-principal-name [2] PrincipalName OPTIONAL,
 665         referral-valid-until     [3] KerberosTime OPTIONAL,
 666         ...
 667 }
 668
 669 END
 670
 671 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1