Kerberos Authentication Study Guide

Kerberos Authentication

Kerberos is a network authentication protocol designed to provide strong authentication for client-server applications by using secret-key cryptography. It was developed at MIT and is widely used in enterprise environments, particularly with Microsoft Active Directory.

What is Kerberos?

Kerberos is a ticket-based authentication system that allows users and services to prove their identity over a non-secure network without transmitting passwords in plain text. It operates on the basis of "tickets" to authenticate and establish secure sessions between parties.

Key Components of Kerberos

• Key Distribution Center (KDC): The central authentication server that consists of three parts:

  • Authentication Server (AS): Verifies user identity and issues Ticket-Granting Tickets (TGTs)

  • Ticket-Granting Server (TGS): Issues service tickets for specific services

  • Database: Stores secrets (keys) for all principals (users and services)

• Principal: An entity (user or service) that can be authenticated

• Realm: A logical authentication domain (typically equivalent to a domain in Windows environments)

• Ticket: A credential that proves a principal's identity

• Authenticator: A credential that proves the ticket presenter is the same as the client named in the ticket

How Kerberos Works: The Authentication Process

Step 1: Authentication Service Exchange

• Client sends a request to the Authentication Server (AS) for a Ticket-Granting Ticket (TGT)

• The request includes the client's identity but not the password

• AS verifies the client exists in its database

• AS responds with:

  • TGT encrypted with the TGS's secret key

  • Session key encrypted with the client's secret key (derived from password)

• Client decrypts the session key using its password-derived key

Step 2: Ticket-Granting Service Exchange

• Client requests access to a specific service from the Ticket-Granting Server (TGS)

• Request includes:

  • The TGT received from AS

  • Authenticator (client identity and timestamp) encrypted with the session key

• TGS decrypts the TGT using its own secret key, extracts the session key

• TGS uses session key to decrypt the authenticator and verify the client's identity

• TGS responds with:

  • Service ticket encrypted with the service's secret key

  • New session key for client-service communication encrypted with the client-TGS session key

Step 3: Client/Service Exchange

• Client requests service from the application server

• Request includes:

  • Service ticket received from TGS

  • New authenticator encrypted with the client-service session key

• Service server decrypts the service ticket using its secret key

• Service extracts the session key and uses it to decrypt the authenticator

• Service verifies the authenticator and may optionally respond with its own authenticator for mutual authentication

• Secure session is established between client and service

Key Features of Kerberos

• Mutual Authentication: Both client and server verify each other's identity

• Single Sign-On (SSO): Users authenticate once and receive tickets for multiple services

• Delegated Authentication: Services can act on behalf of users

• Replay Protection: Timestamps prevent reuse of authentication messages

• Forward Secrecy: Compromise of long-term keys doesn't compromise past sessions

Advantages of Kerberos

• Passwords never transmitted over the network

• Reduced password fatigue through single sign-on

• Standardized protocol with wide industry support

• Strong security through symmetric cryptography

• Scalable for large enterprise environments

Security Considerations

• Time Synchronization: Kerberos requires all systems to be time-synchronized (typically within 5 minutes)

• Key Management: Secure storage and rotation of secret keys is critical

• KDC Availability: The KDC represents a single point of failure

• Ticket Lifetime: Shorter ticket lifetimes improve security but increase authentication frequency

• Offline Attacks: Weak user passwords can be vulnerable to offline attacks against captured tickets

Common Kerberos Implementations

• Microsoft Active Directory (most widespread implementation)

• MIT Kerberos (reference implementation)

• Heimdal Kerberos (another open-source implementation)

• Various UNIX/Linux distributions with Kerberos support

Study Tips

• Focus on understanding the three-step exchange process (AS, TGS, Client/Service)

• Memorize what each component encrypts and with which keys

• Understand the difference between tickets and authenticators

• Practice diagramming the authentication flow

• Learn how Kerberos integrates with SSO solutions