usr/share/man/cat3/krb.0



KERBEROS(3)                    4.0                    KERBEROS(3)


N\bNA\bAM\bME\bE
     krb_mk_req, krb_rd_req, krb_kntoln, krb_set_key,
     krb_get_cred, krb_mk_priv, krb_rd_priv, krb_mk_safe,
     krb_rd_safe, krb_mk_err, krb_rd_err, krb_ck_repl - Kerberos
     authentication library

S\bSY\bYN\bNO\bOP\bPS\bSI\bIS\bS
     #\b#i\bin\bnc\bcl\blu\bud\bde\be <\b<k\bke\ber\brb\bbe\ber\bro\bos\bsI\bIV\bV/\b/d\bde\bes\bs.\b.h\bh>\b>
     #\b#i\bin\bnc\bcl\blu\bud\bde\be <\b<k\bke\ber\brb\bbe\ber\bro\bos\bsI\bIV\bV/\b/k\bkr\brb\bb.\b.h\bh>\b>

     e\bex\bxt\bte\ber\brn\bn c\bch\bha\bar\br *\b*k\bkr\brb\bb_\b_e\ber\brr\br_\b_t\btx\bxt\bt[\b[]\b];\b;

     i\bin\bnt\bt k\bkr\brb\bb_\b_m\bmk\bk_\b_r\bre\beq\bq(\b(a\bau\but\bth\bhe\ben\bnt\bt,\b,s\bse\ber\brv\bvi\bic\bce\be,\b,i\bin\bns\bst\bta\ban\bnc\bce\be,\b,r\bre\bea\bal\blm\bm,\b,c\bch\bhe\bec\bck\bks\bsu\bum\bm)\b)
     K\bKT\bTE\bEX\bXT\bT a\bau\but\bth\bhe\ben\bnt\bt;\b;
     c\bch\bha\bar\br *\b*s\bse\ber\brv\bvi\bic\bce\be;\b;
     c\bch\bha\bar\br *\b*i\bin\bns\bst\bta\ban\bnc\bce\be;\b;
     c\bch\bha\bar\br *\b*r\bre\bea\bal\blm\bm;\b;
     u\bu_\b_l\blo\bon\bng\bg c\bch\bhe\bec\bck\bks\bsu\bum\bm;\b;

     i\bin\bnt\bt k\bkr\brb\bb_\b_r\brd\bd_\b_r\bre\beq\bq(\b(a\bau\but\bth\bhe\ben\bnt\bt,\b,s\bse\ber\brv\bvi\bic\bce\be,\b,i\bin\bns\bst\bta\ban\bnc\bce\be,\b,f\bfr\bro\bom\bm_\b_a\bad\bdd\bdr\br,\b,a\bad\bd,\b,f\bfn\bn)\b)
     K\bKT\bTE\bEX\bXT\bT a\bau\but\bth\bhe\ben\bnt\bt;\b;
     c\bch\bha\bar\br *\b*s\bse\ber\brv\bvi\bic\bce\be;\b;
     c\bch\bha\bar\br *\b*i\bin\bns\bst\bta\ban\bnc\bce\be;\b;
     u\bu_\b_l\blo\bon\bng\bg f\bfr\bro\bom\bm_\b_a\bad\bdd\bdr\br;\b;
     A\bAU\bUT\bTH\bH_\b_D\bDA\bAT\bT *\b*a\bad\bd;\b;
     c\bch\bha\bar\br *\b*f\bfn\bn;\b;

     i\bin\bnt\bt k\bkr\brb\bb_\b_k\bkn\bnt\bto\bol\bln\bn(\b(a\bad\bd,\b,l\bln\bna\bam\bme\be)\b)
     A\bAU\bUT\bTH\bH_\b_D\bDA\bAT\bT *\b*a\bad\bd;\b;
     c\bch\bha\bar\br *\b*l\bln\bna\bam\bme\be;\b;

     i\bin\bnt\bt k\bkr\brb\bb_\b_s\bse\bet\bt_\b_k\bke\bey\by(\b(k\bke\bey\by,\b,c\bcv\bvt\bt)\b)
     c\bch\bha\bar\br *\b*k\bke\bey\by;\b;
     i\bin\bnt\bt c\bcv\bvt\bt;\b;

     i\bin\bnt\bt k\bkr\brb\bb_\b_g\bge\bet\bt_\b_c\bcr\bre\bed\bd(\b(s\bse\ber\brv\bvi\bic\bce\be,\b,i\bin\bns\bst\bta\ban\bnc\bce\be,\b,r\bre\bea\bal\blm\bm,\b,c\bc)\b)
     c\bch\bha\bar\br *\b*s\bse\ber\brv\bvi\bic\bce\be;\b;
     c\bch\bha\bar\br *\b*i\bin\bns\bst\bta\ban\bnc\bce\be;\b;
     c\bch\bha\bar\br *\b*r\bre\bea\bal\blm\bm;\b;
     C\bCR\bRE\bED\bDE\bEN\bNT\bTI\bIA\bAL\bLS\bS *\b*c\bc;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_m\bmk\bk_\b_p\bpr\bri\biv\bv(\b(i\bin\bn,\b,o\bou\but\bt,\b,i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh,\b,s\bsc\bch\bhe\bed\bdu\bul\ble\be,\b,k\bke\bey\by,\b,s\bse\ben\bnd\bde\ber\br,\b,r\bre\bec\bce\bei\biv\bve\ber\br)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*i\bin\bn;\b;
     u\bu_\b_c\bch\bha\bar\br *\b*o\bou\but\bt;\b;
     u\bu_\b_l\blo\bon\bng\bg i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh;\b;
     d\bde\bes\bs_\b_c\bcb\bbl\blo\boc\bck\bk k\bke\bey\by;\b;
     d\bde\bes\bs_\b_k\bke\bey\by_\b_s\bsc\bch\bhe\bed\bdu\bul\ble\be s\bsc\bch\bhe\bed\bdu\bul\ble\be;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*s\bse\ben\bnd\bde\ber\br;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*r\bre\bec\bce\bei\biv\bve\ber\br;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_r\brd\bd_\b_p\bpr\bri\biv\bv(\b(i\bin\bn,\b,i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh,\b,s\bsc\bch\bhe\bed\bdu\bul\ble\be,\b,k\bke\bey\by,\b,s\bse\ben\bnd\bde\ber\br,\b,r\bre\bec\bce\bei\biv\bve\ber\br,\b,m\bms\bsg\bg_\b_d\bda\bat\bta\ba)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*i\bin\bn;\b;


Printed 7/27/90             Kerberos                            1


KERBEROS(3)                    4.0                    KERBEROS(3)


     u\bu_\b_l\blo\bon\bng\bg i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh;\b;
     K\bKe\bey\by_\b_s\bsc\bch\bhe\bed\bdu\bul\ble\be s\bsc\bch\bhe\bed\bdu\bul\ble\be;\b;
     d\bde\bes\bs_\b_c\bcb\bbl\blo\boc\bck\bk k\bke\bey\by;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*s\bse\ben\bnd\bde\ber\br;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*r\bre\bec\bce\bei\biv\bve\ber\br;\b;
     M\bMS\bSG\bG_\b_D\bDA\bAT\bT *\b*m\bms\bsg\bg_\b_d\bda\bat\bta\ba;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_m\bmk\bk_\b_s\bsa\baf\bfe\be(\b(i\bin\bn,\b,o\bou\but\bt,\b,i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh,\b,k\bke\bey\by,\b,s\bse\ben\bnd\bde\ber\br,\b,r\bre\bec\bce\bei\biv\bve\ber\br)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*i\bin\bn;\b;
     u\bu_\b_c\bch\bha\bar\br *\b*o\bou\but\bt;\b;
     u\bu_\b_l\blo\bon\bng\bg i\bin\bn_\b_l\ble\ben\bng\bgt\bth\bh;\b;
     d\bde\bes\bs_\b_c\bcb\bbl\blo\boc\bck\bk k\bke\bey\by;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*s\bse\ben\bnd\bde\ber\br;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*r\bre\bec\bce\bei\biv\bve\ber\br;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_r\brd\bd_\b_s\bsa\baf\bfe\be(\b(i\bin\bn,\b,l\ble\ben\bng\bgt\bth\bh,\b,k\bke\bey\by,\b,s\bse\ben\bnd\bde\ber\br,\b,r\bre\bec\bce\bei\biv\bve\ber\br,\b,m\bms\bsg\bg_\b_d\bda\bat\bta\ba)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*i\bin\bn;\b;
     u\bu_\b_l\blo\bon\bng\bg l\ble\ben\bng\bgt\bth\bh;\b;
     d\bde\bes\bs_\b_c\bcb\bbl\blo\boc\bck\bk k\bke\bey\by;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*s\bse\ben\bnd\bde\ber\br;\b;
     s\bst\btr\bru\buc\bct\bt s\bso\boc\bck\bka\bad\bdd\bdr\br_\b_i\bin\bn *\b*r\bre\bec\bce\bei\biv\bve\ber\br;\b;
     M\bMS\bSG\bG_\b_D\bDA\bAT\bT *\b*m\bms\bsg\bg_\b_d\bda\bat\bta\ba;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_m\bmk\bk_\b_e\ber\brr\br(\b(o\bou\but\bt,\b,c\bco\bod\bde\be,\b,s\bst\btr\bri\bin\bng\bg)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*o\bou\but\bt;\b;
     l\blo\bon\bng\bg c\bco\bod\bde\be;\b;
     c\bch\bha\bar\br *\b*s\bst\btr\bri\bin\bng\bg;\b;

     l\blo\bon\bng\bg k\bkr\brb\bb_\b_r\brd\bd_\b_e\ber\brr\br(\b(i\bin\bn,\b,l\ble\ben\bng\bgt\bth\bh,\b,c\bco\bod\bde\be,\b,m\bms\bsg\bg_\b_d\bda\bat\bta\ba)\b)
     u\bu_\b_c\bch\bha\bar\br *\b*i\bin\bn;\b;
     u\bu_\b_l\blo\bon\bng\bg l\ble\ben\bng\bgt\bth\bh;\b;
     l\blo\bon\bng\bg c\bco\bod\bde\be;\b;
     M\bMS\bSG\bG_\b_D\bDA\bAT\bT *\b*m\bms\bsg\bg_\b_d\bda\bat\bta\ba;\b;

D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
     This library supports network authentication and various
     related operations.  The library contains many routines
     beyond those described in this man page, but they are not
     intended to be used directly.  Instead, they are called by
     the routines that are described, the authentication server
     and the login program.

     _\bk_\br_\bb__\be_\br_\br__\bt_\bx_\bt[] contains text string descriptions of various
     Kerberos error codes returned by some of the routines below.

     _\bk_\br_\bb__\bm_\bk__\br_\be_\bq takes a pointer to a text structure in which an
     authenticator is to be built.  It also takes the name,
     instance, and realm of the service to be used and an
     optional checksum.  It is up to the application to decide
     how to generate the checksum.  _\bk_\br_\bb__\bm_\bk__\br_\be_\bq then retrieves a
     ticket for the desired service and creates an authenticator.
     The authenticator is built in _\ba_\bu_\bt_\bh_\be_\bn_\bt and is accessible to


Printed 7/27/90             Kerberos                            2


KERBEROS(3)                    4.0                    KERBEROS(3)


     the calling procedure.

     It is up to the application to get the authenticator to the
     service where it will be read by _\bk_\br_\bb__\br_\bd__\br_\be_\bq. Unless an
     attacker posesses the session key contained in the ticket,
     it will be unable to modify the authenticator.  Thus, the
     checksum can be used to verify the authenticity of the other
     data that will pass through a connection.

     _\bk_\br_\bb__\br_\bd__\br_\be_\bq takes an authenticator of type K\bKT\bTE\bEX\bXT\bT,\b, a service
     name, an instance, the address of the host originating the
     request, and a pointer to a structure of type A\bAU\bUT\bTH\bH_\b_D\bDA\bAT\bT which
     is filled in with information obtained from the authentica-
     tor.  It also optionally takes the name of the file in which
     it will find the secret key(s) for the service.  If the sup-
     plied _\bi_\bn_\bs_\bt_\ba_\bn_\bc_\be contains "*", then the first service key with
     the same service name found in the service key file will be
     used, and the _\bi_\bn_\bs_\bt_\ba_\bn_\bc_\be argument will be filled in with the
     chosen instance.  This means that the caller must provide
     space for such an instance name.

     It is used to find out information about the principal when
     a request has been made to a service.  It is up to the
     application protocol to get the authenticator from the
     client to the service.  The authenticator is then passed to
     _\bk_\br_\bb__\br_\bd__\br_\be_\bq to extract the desired information.

     _\bk_\br_\bb__\br_\bd__\br_\be_\bq returns zero (RD_AP_OK) upon successful authenti-
     cation.  If a packet was forged, modified, or replayed,
     authentication will fail.  If the authentication fails, a
     non-zero value is returned indicating the particular problem
     encountered.  See _\bk_\br_\bb._\bh for the list of error codes.

     If the last argument is the null string (""), krb_rd_req
     will use the file /etc/srvtab to find its keys.  If the last
     argument is NULL, it will assume that the key has been set
     by _\bk_\br_\bb__\bs_\be_\bt__\bk_\be_\by and will not bother looking further.

     _\bk_\br_\bb__\bk_\bn_\bt_\bo_\bl_\bn converts a Kerberos name to a local name.  It
     takes a structure of type AUTH_DAT and uses the name and
     instance to look in the database /etc/aname to find the
     corresponding local name.  The local name is returned and
     can be used by an application to change uids, directories,
     or other parameters.  It is not an integral part of Ker-
     beros, but is instead provided to support the use of Ker-
     beros in existing utilities.

     _\bk_\br_\bb__\bs_\be_\bt__\bk_\be_\by takes as an argument a des key.  It then creates
     a key schedule from it and saves the original key to be used
     as an initialization vector.  It is used to set the server's
     key which must be used to decrypt tickets.


Printed 7/27/90             Kerberos                            3


KERBEROS(3)                    4.0                    KERBEROS(3)


     If called with a non-zero second argument, _\bk_\br_\bb__\bs_\be_\bt__\bk_\be_\by will
     first convert the input from a string of arbitrary length to
     a DES key by encrypting it with a one-way function.

     In most cases it should not be necessary to call
     _\bk_\br_\bb__\bs_\be_\bt__\bk_\be_\by. The necessary keys will usually be obtained and
     set inside _\bk_\br_\bb__\br_\bd__\br_\be_\bq. _\bk_\br_\bb__\bs_\be_\bt__\bk_\be_\by is provided for those
     applications that do not wish to place the application keys
     on disk.

     _\bk_\br_\bb__\bg_\be_\bt__\bc_\br_\be_\bd searches the caller's ticket file for a ticket
     for the given service, instance, and realm; and, if a ticket
     is found, fills in the given CREDENTIALS structure with the
     ticket information.

     If the ticket was found, _\bk_\br_\bb__\bg_\be_\bt__\bc_\br_\be_\bd returns GC_OK.  If the
     ticket file can't be found, can't be read, doesn't belong to
     the user (other than root), isn't a regular file, or is in
     the wrong mode, the error GC_TKFIL is returned.

     _\bk_\br_\bb__\bm_\bk__\bp_\br_\bi_\bv creates an encrypted, authenticated message from
     any arbitrary application data, pointed to by _\bi_\bn and
     _\bi_\bn__\bl_\be_\bn_\bg_\bt_\bh bytes long.  The private session key, pointed to
     by _\bk_\be_\by and the key schedule, _\bs_\bc_\bh_\be_\bd_\bu_\bl_\be, are used to encrypt
     the data and some header information using _\bp_\bc_\bb_\bc__\be_\bn_\bc_\br_\by_\bp_\bt.
     _\bs_\be_\bn_\bd_\be_\br and _\br_\be_\bc_\be_\bi_\bv_\be_\br point to the Internet address of the two
     parties.  In addition to providing privacy, this protocol
     message protects against modifications, insertions or
     replays.  The encapsulated message and header are placed in
     the area pointed to by _\bo_\bu_\bt and the routine returns the
     length of the output, or -1 indicating an error.

     _\bk_\br_\bb__\br_\bd__\bp_\br_\bi_\bv decrypts and authenticates a received
     _\bk_\br_\bb__\bm_\bk__\bp_\br_\bi_\bv message.  _\bi_\bn points to the beginning of the
     received message, whose length is specified in _\bi_\bn__\bl_\be_\bn_\bg_\bt_\bh.
     The private session key, pointed to by _\bk_\be_\by, and the key
     schedule, _\bs_\bc_\bh_\be_\bd_\bu_\bl_\be, are used to decrypt and verify the
     received message.  _\bm_\bs_\bg__\bd_\ba_\bt_\ba is a pointer to a _\bM_\bS_\bG__\bD_\bA_\bT
     struct, defined in _\bk_\br_\bb._\bh. The routine fills in the _\ba_\bp_\bp__\bd_\ba_\bt_\ba
     field with a pointer to the decrypted application data,
     _\ba_\bp_\bp__\bl_\be_\bn_\bg_\bt_\bh with the length of the _\ba_\bp_\bp__\bd_\ba_\bt_\ba field, _\bt_\bi_\bm_\be__\bs_\be_\bc
     and _\bt_\bi_\bm_\be__\b5_\bm_\bs with the timestamps in the message, and _\bs_\bw_\ba_\bp
     with a 1 if the byte order of the receiver is different than
     that of the sender.  (The application must still determine
     if it is appropriate to byte-swap application data; the Ker-
     beros protocol fields are already taken care of).  The _\bh_\ba_\bs_\bh
     field returns a value useful as input to the _\bk_\br_\bb__\bc_\bk__\br_\be_\bp_\bl
     routine.

     The routine returns zero if ok, or a Kerberos error code.
     Modified messages and old messages cause errors, but it is
     up to the caller to check the time sequence of messages, and


Printed 7/27/90             Kerberos                            4


KERBEROS(3)                    4.0                    KERBEROS(3)


     to check against recently replayed messages using
     _\bk_\br_\bb__\bc_\bk__\br_\be_\bp_\bl if so desired.

     _\bk_\br_\bb__\bm_\bk__\bs_\ba_\bf_\be creates an authenticated, but unencrypted mes-
     sage from any arbitrary application data, pointed to by _\bi_\bn
     and _\bi_\bn__\bl_\be_\bn_\bg_\bt_\bh bytes long.  The private session key, pointed
     to by _\bk_\be_\by, is used to seed the _\bq_\bu_\ba_\bd__\bc_\bk_\bs_\bu_\bm() checksum algo-
     rithm used as part of the authentication.  _\bs_\be_\bn_\bd_\be_\br and
     _\br_\be_\bc_\be_\bi_\bv_\be_\br point to the Internet address of the two parties.
     This message does not provide privacy, but does protect (via
     detection) against modifications, insertions or replays.
     The encapsulated message and header are placed in the area
     pointed to by _\bo_\bu_\bt and the routine returns the length of the
     output, or -1 indicating an error.  The authentication pro-
     vided by this routine is not as strong as that provided by
     _\bk_\br_\bb__\bm_\bk__\bp_\br_\bi_\bv or by computing the checksum using _\bc_\bb_\bc__\bc_\bk_\bs_\bu_\bm
     instead, both of which authenticate via DES.

     _\bk_\br_\bb__\br_\bd__\bs_\ba_\bf_\be authenticates a received _\bk_\br_\bb__\bm_\bk__\bs_\ba_\bf_\be message.
     _\bi_\bn points to the beginning of the received message, whose
     length is specified in _\bi_\bn__\bl_\be_\bn_\bg_\bt_\bh. The private session key,
     pointed to by _\bk_\be_\by, is used to seed the quad_cksum() routine
     as part of the authentication.  _\bm_\bs_\bg__\bd_\ba_\bt_\ba is a pointer to a
     _\bM_\bS_\bG__\bD_\bA_\bT struct, defined in _\bk_\br_\bb._\bh . The routine fills in
     these _\bM_\bS_\bG__\bD_\bA_\bT fields: the _\ba_\bp_\bp__\bd_\ba_\bt_\ba field with a pointer to
     the application data, _\ba_\bp_\bp__\bl_\be_\bn_\bg_\bt_\bh with the length of the
     _\ba_\bp_\bp__\bd_\ba_\bt_\ba field, _\bt_\bi_\bm_\be__\bs_\be_\bc and _\bt_\bi_\bm_\be__\b5_\bm_\bs with the timestamps in
     the message, and _\bs_\bw_\ba_\bp with a 1 if the byte order of the
     receiver is different than that of the sender.  (The appli-
     cation must still determine if it is appropriate to byte-
     swap application data; the Kerberos protocol fields are
     already taken care of).  The _\bh_\ba_\bs_\bh field returns a value use-
     ful as input to the _\bk_\br_\bb__\bc_\bk__\br_\be_\bp_\bl routine.

     The routine returns zero if ok, or a Kerberos error code.
     Modified messages and old messages cause errors, but it is
     up to the caller to check the time sequence of messages, and
     to check against recently replayed messages using
     _\bk_\br_\bb__\bc_\bk__\br_\be_\bp_\bl if so desired.

     _\bk_\br_\bb__\bm_\bk__\be_\br_\br constructs an application level error message
     that may be used along with _\bk_\br_\bb__\bm_\bk__\bp_\br_\bi_\bv or _\bk_\br_\bb__\bm_\bk__\bs_\ba_\bf_\be. _\bo_\bu_\bt
     is a pointer to the output buffer, _\bc_\bo_\bd_\be is an application
     specific error code, and _\bs_\bt_\br_\bi_\bn_\bg is an application specific
     error string.


     _\bk_\br_\bb__\br_\bd__\be_\br_\br unpacks a received _\bk_\br_\bb__\bm_\bk__\be_\br_\br message.  _\bi_\bn points
     to the beginning of the received message, whose length is
     specified in _\bi_\bn__\bl_\be_\bn_\bg_\bt_\bh. _\bc_\bo_\bd_\be is a pointer to a value to be
     filled in with the error value provided by the application.
     _\bm_\bs_\bg__\bd_\ba_\bt_\ba is a pointer to a _\bM_\bS_\bG__\bD_\bA_\bT struct, defined in _\bk_\br_\bb._\bh


Printed 7/27/90             Kerberos                            5


KERBEROS(3)                    4.0                    KERBEROS(3)


     . The routine fills in these _\bM_\bS_\bG__\bD_\bA_\bT fields: the _\ba_\bp_\bp__\bd_\ba_\bt_\ba
     field with a pointer to the application error text,
     _\ba_\bp_\bp__\bl_\be_\bn_\bg_\bt_\bh with the length of the _\ba_\bp_\bp__\bd_\ba_\bt_\ba field, and _\bs_\bw_\ba_\bp
     with a 1 if the byte order of the receiver is different than
     that of the sender.  (The application must still determine
     if it is appropriate to byte-swap application data; the Ker-
     beros protocol fields are already taken care of).

     The routine returns zero if the error message has been suc-
     cessfully received, or a Kerberos error code.

     The _\bK_\bT_\bE_\bX_\bT structure is used to pass around text of varying
     lengths.  It consists of a buffer for the data, and a
     length.  krb_rd_req takes an argument of this type contain-
     ing the authenticator, and krb_mk_req returns the authenti-
     cator in a structure of this type.  KTEXT itself is really a
     pointer to the structure.   The actual structure is of type
     KTEXT_ST.

     The _\bA_\bU_\bT_\bH__\bD_\bA_\bT structure is filled in by krb_rd_req.  It must
     be allocated before calling krb_rd_req, and a pointer to it
     is passed.  The structure is filled in with data obtained
     from Kerberos.  _\bM_\bS_\bG__\bD_\bA_\bT structure is filled in by either
     krb_rd_priv, krb_rd_safe, or krb_rd_err.  It must be allo-
     cated before the call and a pointer to it is passed.  The
     structure is filled in with data obtained from Kerberos.

F\bFI\bIL\bLE\bES\bS
     /usr/include/kerberosIV/krb.h
     /usr/lib/libkrb.a
     /usr/include/kerberosIV/des.h
     /usr/lib/libdes.a
     /etc/kerberosIV/aname
     /etc/kerberosIV/srvtab
     /tmp/tkt[uid]

S\bSE\bEE\bE A\bAL\bLS\bSO\bO
     kerberos(1), des_crypt(3)

D\bDI\bIA\bAG\bGN\bNO\bOS\bST\bTI\bIC\bCS\bS
B\bBU\bUG\bGS\bS
     The caller of _\bk_\br_\bb__\br_\bd__\br_\be_\bq, _\bk_\br_\bb__\br_\bd__\bp_\br_\bi_\bv, _\ba_\bn_\bd _\bk_\br_\bb__\br_\bd__\bs_\ba_\bf_\be must
     check time order and for replay attempts.  _\bk_\br_\bb__\bc_\bk__\br_\be_\bp_\bl is
     not implemented yet.

A\bAU\bUT\bTH\bHO\bOR\bRS\bS
     Clifford Neuman, MIT Project Athena
     Steve Miller, MIT Project Athena/Digital Equipment Corpora-
     tion

R\bRE\bES\bST\bTR\bRI\bIC\bCT\bTI\bIO\bON\bNS\bS
     COPYRIGHT 1985,1986,1989 Massachusetts Institute of


Printed 7/27/90             Kerberos                            6


KERBEROS(3)                    4.0                    KERBEROS(3)


     Technology


Printed 7/27/90             Kerberos                            7