1.3 Overview

The PKINIT protocol is a security protocol that authenticates entities on a network using public key cryptography. Kerberos is a security protocol that mutually authenticates entities on a network and can provide user credential delegation after authentication is complete. Kerberos is specified in [RFC4120] and [MS-KILE], and PKINIT is specified in [RFC4556]. [RFC5349] specifies the use of elliptic curve cryptography (ECC) within the framework of PKINIT. PKINIT is a pre-authentication extension that extends the Kerberos Protocol to use public key cryptography and ticket-granting ticket (TGT) data signing during the initial AS exchange.

This specification describes the extensions to PKINIT that enable the use of public key cryptography in the initial authentication exchanges of the Kerberos protocol (Authentication Service (AS) exchange) [RFC4120].