910

Port 910 is registered with IANA as kink with the description "Kerberized Internet Negotiation of Keys (KINK)" and a reference of [RFC4430] on both the TCP and UDP rows (verified against the live registry CSV), with the assignee and contact blank, reflecting an IETF Standards-Track assignment. KINK (RFC 4430, March 2006) establishes and maintains IPsec security associations using Kerberos for authentication instead of IKE's certificate or pre-shared-key plus Diffie-Hellman model: it reuses IKE Quick Mode payloads — easing implementation reuse — is a stateless command and response protocol built from GETTGT, CREATE, DELETE, and STATUS commands with REPLY and ACK responses, and mitigates denial-of-service by requiring authenticated exchanges before public-key operations and state installation. RFC 4430 specifies that KINK uses UDP on port 910 to transport its messages, so it is fundamentally a UDP protocol with the TCP registration as the standard IANA sibling. Its purpose is IPsec keying in Kerberos environments, letting Kerberos-authenticated hosts set up IPsec security associations through a central KDC without a separate public-key infrastructure; it was implemented in Racoon2 (the WIDE/KAME lineage, via the kinkd daemon) on BSD and Linux but never achieved wide deployment. The IANA reference is [RFC4430]. Security-wise KINK shifts trust to the Kerberos KDC, so the realm's security underpins the IPsec it keys, and it ties into the broader Kerberos cluster. For an analyst, an open 910 indicates a rare KINK or IPsec-with-Kerberos deployment and relates to the Kerberos ports (88, 464) and to IKE (500, 4500); prevalence is low.

IANA assignment

kink — "Kerberized Internet Negotiation of Keys (KINK)"; reference [RFC4430]; assignee/contact blank (IETF Standards-Track); dual-registered 910/tcp + 910/udp (UDP is the operational transport per RFC 4430 §9)

[IANA-assigned, verified live] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

low; nmap-services de-facto low [Well-established] — nmap-services file

Related ports

88/464 (Kerberos, done), 500/4500 (IKE/IPsec, done)

Primary use

IPsec SA keying using Kerberos authentication (alternative to IKE)

Other/unofficial uses

none meaningful [Well-established]

Security implications

trust shifts to the Kerberos KDC — the realm's security underpins the IPsec KINK keys; never widely deployed [Well-established]

Typically seen on

Kerberos-IPsec hosts (Racoon2 kinkd on BSD/Linux)

Analyst note

An open 910 indicates a rare KINK / IPsec-with-Kerberos deployment; relate to the Kerberos cluster and IKE.