Scribd
Upload
66 views13 pages

Unit IV Kerberos

Kerberos is an authentication protocol that uses tickets to allow nodes on a non-secure network to prove their identity to each other securely. It involves three servers: an authentication server that issues tickets, a ticket granting server that issues tickets to real servers, and real servers that provide services. The authentication server issues a ticket for the ticket granting server after verifying a user's identity. The ticket granting server then issues a ticket for the real server. This establishes a shared secret key between the user and server that can be used to authenticate future requests.

Uploaded by

Chinamayi Chinmayi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
66 views13 pages

Unit IV Kerberos

Kerberos is an authentication protocol that uses tickets to allow nodes on a non-secure network to prove their identity to each other securely. It involves three servers: an authentication server that issues tickets, a ticket granting server that issues tickets to real servers, and real servers that provide services. The authentication server issues a ticket for the ticket granting server after verifying a user's identity. The ticket granting server then issues a ticket for the real server. This establishes a shared secret key between the user and server that can be used to authenticate future requests.

Uploaded by

Chinamayi Chinmayi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 13

Kerberos: Authentication

Application
Authentication
Authentication means verifying identity and then we have send the message to the
receiver

Before starting the communication, sender should authenticated by the receiver and
receiver should be authenticated by the sender
Introduction to Kerberos
Provides
strong security on physically insecure network

a centralized authentication server whichauthenticates


Users to servers
Servers to users

Relies on conventional encryption rather than public-key


encryption

3
Kerberos is a computer network authentication
protocol

 Works on the basis of 'tickets' to allow nodes


communicating over a non-secure network
 Prove their identity to one another in a secure manner
 Aimed primarily at a client–server model and it provides
mutual authentication

 Protected against eavesdropping and replay attacks


Three servers are involved in the Kerberos protocol:
I. An authentication server
II. A ticket granting server
III. A real server

Authentication server- Each user registers with AS and chooses a identity and
password. The AS has database with these identities and passwords. The AS verifies
the user, issues a session key to be used between user and TGS, and sends tickets
for the TGS.

Ticket granting server- The ticket granting server issues a ticket for real server.
It also provides the session key between user and server. Ticket contains the
user’s ID and network address and the server’s ID.

Real server- The real server provides services to the user.


Summary of Kerberos Version 4 Message Exchanges
(1) C -> AS : IDC || IDtgs || TS1
– C = client
– AS = authentication server
– IDC = identity of user on C
– IDtgs = identity of ticket granting server
– TS1= Time stamp
(2) AS -> C : E(KC [KC ,tgs || IDtgs || TS2 || Lifetime2||Ticket tgs ])

Ticket tgs =E(Ktgs [KC ,tgs || IDC || ADC || IDtgs || TS2 || Lifetime2 ])

AS responds with a message, encrypted with a key derived from the user’s password (KC),
that contains the ticket.

The encrypted message also contains a copy of the session key, KC ,tgs , where subscripts
indicate that this session key is shared between client and ticket granting server.

This session key is inside the message encrypted with KC , only the user’s can read it.

The same session key is included in the ticket, which can be read only by TGS.

The session key securely delivered to both C and TGS.

ADC : Network address of C

 Lifetime2 : Expiration time


3. C -> TGS : IDv || Ticket tgs || Authenticatorc
Authenticatorc=E(KC ,tgs [IDC || ADC || TS3 ])
(4) TGS -> C : E(KC,tgs [KC ,v || IDV|| TS4 ||Ticket v ])

Ticket v = E(Kv [KC ,V || IDC|| ADC || IDV|| TS4 || Lifetime 4 ])

The reply from message 4 follows the form of message 2

The message is encrypted with the session key shared between TGS and C and includes
a session key to be shared between C and server, Identity of server, Ticket and
timestamp. The ticket includes same session key

Client has now a reusable service granting ticket for server V


5. C -> V : Ticket V || Authenticatorc

Client sends ticket and authenticator to server.


Server can decrypt the ticket, recover the session key and decrypt the authenticator

6. V -> C : = E(KC,V [TS5 +1]) (For mutual authentication)

 If mutual authentication is required, the server returns the timestamp from the
Authenticator, incremented by 1, and encrypted in the session key.

 C can decrypt this message to recover the incremented timestamp.

 Finally, at the conclusion of this process, the client and server share a secret key.

The Key can be used to encrypt future messages between the two.

You might also like