Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. It was developed as part of MIT’s Project Athena and is widely implemented, including in Windows operating systems, where it replaced the NT-LAN Manager (NTLM).

Key Elements of Kerberos

1. Authentication: Verifies the identity of users attempting to access the network.
2. Authorization: Determines what resources an authenticated user is allowed to access.
3. Auditing: Tracks user activities for security and compliance purposes.

Key Features

• Symmetric Key Cryptology: Kerberos relies on symmetric key cryptography for secure communication between clients and servers.
• Confidentiality and Integrity: It ensures that data remains confidential and unaltered during transmission.
• Authentication, Not Availability: While it handles authentication well, it doesn’t address availability issues directly.
• Time Synchronization: Kerberos requires synchronized clocks (within a few minutes) across the network to prevent replay attacks.
• Password Protection: Passwords are never sent over the network in plaintext; instead, Kerberos uses hashed passwords for authentication.

Components of Kerberos

• Key Distribution Center (KDC): The central authority in the Kerberos protocol that manages secret keys and tickets. The KDC is a single point of failure.
• Authentication Server (AS): Part of the KDC, responsible for verifying user identities and issuing Ticket Granting Tickets (TGTs).
• Ticket Granting Server (TGS): Also part of the KDC, it issues service tickets based on TGTs, allowing users to access network services.

Kerberos Logon Process

1. Initial Logon: The user enters a username and password on the client.
2. Request for TGT: The client encrypts the username using AES and sends it to the KDC.
3. KDC Response: The KDC verifies the credentials, generates a symmetric key for the client, encrypts it with a hash of the user’s password, and creates a time-stamped TGT.
4. Client Action: The client installs the TGT and decrypts the symmetric key using the hashed password.
5. Service Access: The client uses the TGT to request service tickets from the TGS, which allows access to specific services.

Benefits of Kerberos

• Cost-Effective: Widely supported across various operating systems and platforms.
• Mature Protocol: Well-established with strong security practices.
• Secure: Passwords are never transmitted in plain text.

Drawbacks of Kerberos

• Administrative Overhead: Complex to set up and maintain.
• Single Point of Failure: The KDC can become a bottleneck or target for attacks, potentially compromising the entire system.

SESAME Overview

• SESAME: Stands for “Secure European System for Applications in a Multi-vendor Environment.” It’s a European alternative to Kerberos, incorporating both symmetric and asymmetric encryption.
• Two Tickets: SESAME uses one ticket for authentication (like Kerberos) and another to define user access privileges, which is known as a Privileged Attribute Certificate (PAC).
• Public Key Cryptology: Unlike Kerberos, SESAME integrates public key cryptography, enhancing security.

Kryptoknight

• IBM’s RACF: Kryptoknight is IBM’s authentication protocol, supporting a peer-to-peer relationship between the KDC and involved parties.

Additional Concepts

• Scripting: Scripts may contain login information for automating user authentication.
• Directory Service: A centralized database (like Active Directory) that includes information about subjects and objects, supporting hierarchical naming and sophisticated security controls.

Kerberos is a robust protocol for secure network authentication but requires careful management and maintenance to prevent vulnerabilities, particularly around the KDC’s central role.