Scribd
Upload
47 views16 pages

Kerberos

Kerberos is a network authentication protocol developed at MIT in the 1980s. It provides strong authentication for client-server applications by using secret key cryptography to allow nodes communicating over an insecure network to verify each other's identity. Kerberos works by having a client first authenticate with a central authentication server to obtain a ticket-granting ticket, then uses that to obtain tickets to access specific services. This prevents sending passwords over the network in cleartext and provides mutual authentication between clients and servers.

Uploaded by

lorowij894
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
47 views16 pages

Kerberos

Kerberos is a network authentication protocol developed at MIT in the 1980s. It provides strong authentication for client-server applications by using secret key cryptography to allow nodes communicating over an insecure network to verify each other's identity. Kerberos works by having a client first authenticate with a central authentication server to obtain a ticket-granting ticket, then uses that to obtain tickets to access specific services. This prevents sending passwords over the network in cleartext and provides mutual authentication between clients and servers.

Uploaded by

lorowij894
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 16

Kerberos

• Akshat Sharma
• Samarth Shah
Outline
Introduction What is Kerberos?

Importance Why Kerberos?

Functionality How Kerberos works?

About Kerberos Model, Functionality, Benefits,


Drawbacks
Conclusion Why it is important?

References Sources of Information


What is Kerberos

• Network authentication protocol.

• Developed at MIT in the mid 1980s.

• A secret key based service for providing


authentication in open networks.

• Provides strong authentication for client-


server applications.
Why Kerberos

• Authentication is a key feature in multi-user


system.
• divide up resources with capabilities

between many users.


• restrict user’s access to resources.
• typical authentication mechanism –
passwords
Why Kerberos

• Sending usernames and passwords in the


clear text jeopardizes the security of the
network.

• Each time a password is sent in the clear


text, there is a chance for interception.

• Firewalls make a risky assumption: that


attackers are coming from the outside. In
reality, attacks frequently come from
within.
Kerberos model

• Kerberos is based on the Secret-Key


Distribution Model that was originally
developed by Needham & Schroeder.
• keys are the basis of authentication in Kerberos.
• typically a short sequence of bytes.
• used to both encrypt & decrypt
Kerberos model

• Encryption => plaintext + Encryption key = ciphertext

• Decryption => ciphertext + Decryption key = plaintext

• Encryption Key – identical to – Decryption Key (in


Conventional Crypto).
Kerberos Basics
• Three basic functions (message exchanges)
• a request and a reply
1. The Authentication Service Exchange
• (Logon)
2. The Ticket-Granting Service Exchange
• (Getting a Ticket to Ride)
3. The Client/Server Authentication Exchange
• (Accessing a Resource)
Functions
• Authentication
• Integrity – Is the assurance that the data received is
the same as generated.
• Confidentiality – is the protection of info from
disclosure to those not intended to receive it.
• Authorization – is the process by which one
determines whether a principal is allowed to perform
an operation. Authorization is done usually after
principal has been authenticated or based on
authenticated statements by others.
Kerberos Functionality
• Instead of client sending password to
application server:
• Request ticket from authentication server
• Ticket and encrypted request sent to application
server

• Steps :
• An user requests use of a network service
• Service wants assurance that user is who he says he is.
(Continued…….)
Kerberos Functionality
• User presents a ticket that is issued to it by a
Kerberos Authentication Server(AS).
• If the ticket is valid, service is granted.
• The tickets must be unequivocally linked to the user
• Ticket demonstrates that the bearer knows
something that only its intended user would know.
• Ticket must obviously be safeguarded against all
attacks.
Benefits of Kerberos
• More efficient authentication to servers.
• Server can authenticate the client by examining
credentials. Clients can obtain credentials for a
particular server once and reuse them throughout a
network logon session.
• Mutual authentication.
• Parties at both ends of a network connection can know
that the party on the other end is who it claims to be.
• Delegated authentication.
• Kerberos protocol has a proxy mechanism that allows
a service to impersonate its client when connecting to
other services.
Drawbacks of Kerberos
• Single point of failure: It requires continuous availability of a
central server. When the Kerberos server is down, no one can
log in.
• Kerberos has strict time requirements, which means the
clocks of the involved hosts must be synchronized within
configured limits.
• The administration protocol is not standardized and differs
between server implementations.
• Since all authentication is controlled by a centralized KDC,
compromise of this authentication infrastructure will allow
an attacker to impersonate any user.
• Each network service which requires a different host name
will need its own set of Kerberos keys. This complicates
virtual hosting and clusters.
Conclusion
• Authentication is critical for the security of computer systems.
Without knowledge of the identity of a principal requesting an
operation, it's difficult to decide whether the operation should
be allowed.

• Traditional authentication methods are not suitable for use in


computer networks where attackers monitor network traffic to
intercept passwords.

• The use of strong authentication methods that do not disclose


passwords is imperative. The Kerberos authentication system is
well suited for authentication of users in such environments.
References

• Kerberos: An Authentication Service for Open


Network Systems
• Steiner, Neuman, Schiller, 1988, Winter USENIX
• http://en.wikipedia.org/wiki/Kerberos_(protocol)
THANK YOU

You might also like