910

Port 910 is registered with IANA as kink with the description "Kerberized Internet Negotiation of Keys (KINK)" and a reference of [RFC4430] on both the TCP and UDP rows (verified against the live registry CSV), with the assignee and contact blank, reflecting an IETF Standards-Track assignment. KINK (RFC 4430, March 2006) establishes and maintains IPsec security associations using Kerberos for authentication instead of IKE's certificate or pre-shared-key plus Diffie-Hellman model: it reuses IKE Quick Mode payloads — easing implementation reuse — is a stateless command and response protocol built from GETTGT, CREATE, DELETE, and STATUS commands with REPLY and ACK responses, and mitigates denial-of-service by requiring authenticated exchanges before public-key operations and state installation. RFC 4430 specifies that KINK uses UDP on port 910 to transport its messages, so it is fundamentally a UDP protocol with the TCP registration as the standard IANA sibling. Its purpose is IPsec keying in Kerberos environments, letting Kerberos-authenticated hosts set up IPsec security associations through a central KDC without a separate public-key infrastructure; it was implemented in Racoon2 (the WIDE/KAME lineage, via the kinkd daemon) on BSD and Linux but never achieved wide deployment. The IANA reference is [RFC4430]. Security-wise KINK shifts trust to the Kerberos KDC, so the realm's security underpins the IPsec it keys, and it ties into the broader Kerberos cluster. For an analyst, an open 910 indicates a rare KINK or IPsec-with-Kerberos deployment and relates to the Kerberos ports (88, 464) and to IKE (500, 4500); prevalence is low.

IANA assignment

kink — "Kerberized Internet Negotiation of Keys (KINK)"; reference [RFC4430]; assignee/contact blank (IETF Standards-Track); dual-registered 910/tcp + 910/udp (UDP is the operational transport per RFC 4430 §9)

[IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

88/464 (Kerberos, done), 500/4500 (IKE/IPsec, done)

Primary use

IPsec SA keying using Kerberos authentication (alternative to IKE)

Other/unofficial uses

none meaningful [Well-established]

Security implications

trust shifts to the Kerberos KDC — the realm's security underpins the IPsec KINK keys; never widely deployed [Well-established]

Typically seen on

Kerberos-IPsec hosts (Racoon2 kinkd on BSD/Linux)

Analyst note

An open 910 indicates a rare KINK / IPsec-with-Kerberos deployment; relate to the Kerberos cluster and IKE.

UDP port 910 is registered for KINK (Kerberized Internet Negotiation of Keys), a protocol for establishing and maintaining IPsec security associations with Kerberos authentication. Whether a particular host runs KINK on this port, or whether it belongs on the public internet, is Unknown from the available evidence.

RFC 4430 describes KINK as a command/response protocol with operations to create, delete, and maintain IPsec security associations. It is designed for centrally managed environments and uses Kerberos mechanisms for mutual authentication and replay protection. These protocol details describe the standard, not observed traffic or current deployment.

The registry assignment does not establish prevalence, typical host types, common applications, or malicious use. Treat traffic attributed to KINK as a protocol identification to validate against the host’s configuration and network context; the supplied evidence does not support a general access policy.

Registered service

KINK (Kerberized Internet Negotiation of Keys) is assigned to UDP port 910. [Confirmed]

Protocol role

KINK uses Kerberos authentication to manage IPsec security associations. [Confirmed]

Public exposure

Whether a host running KINK should be internet-facing is Unknown from the supplied evidence.

Service name

kink [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Protocol reference

RFC 4430

Protocol function

Establishes and maintains IPsec security associations using Kerberos authentication

Deployment or traffic on a specific host

Unknown [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv

Public internet access policy

Unknown [Unknown] — https://www.rfc-editor.org/rfc/rfc4430.txt