Kerberos

Kerberos

What is Kerberos (a quick description)?

Originally developed at MIT, Kerberos is an authentication service. An authentication service is merely a way of assuring that a user is who they claim to be. Kerberos accomplishes this by using a ticket system, which will be described later. Kerberos also provides encryption for its services, in hopes of allowing the authentication process to be less vulnerable to attacks over a network. The default cryptography algorithm for Kerberos V4 is DES (Data Encryption Standard), which has been shown to be crackable. Although the standard still requires DES to be available in Kerberos, it will soon require the use or triple-DES (168 bit). Kerberos V5 is more modular and allows you to switch algorithms easier than V4. Cryptography is considered a munition by the US government and is therefore not allowed to be exported. The overseas versions of Kerberos, exported without the cryptology algorithm, is referred to as bone or e-bones. Kerberos is a standard within the Internet Engineering Task Force.

How Kerberos works:

If a user intends to access a ftp service on a Kerberos enabled machine, he must first initialize himself with the KDC. Upon initialization, the user is granted a ticket granting ticket (TGT). The ftp service must also initialize itself with the KDC. Once the user and the ftp service have been issued TGT's, the user can proceed with an attempt to access the ftp service.

The next step requires the user to inform the KDC that he wants to access the ftp service on a certain machine. The KDC then creates two copies a session key. This key will only be used by the user and the ftp service for direct communication between one another. Both copies of the session key are sent to the user. However, one key is encrypted from the user's TGT, the other is encrypted from the ftp services' TGT. When the user receives both copies of the session key, he is only able to decrypt the copy encrypted form his own TGT. The user then encrypts a timestamp from his local machine using the session key granted by the KDC. This encrypted timestamp and the second copy of the encrypted session key are then sent by the user to the ftp service.

The ftp service first decrypts the second copy of the session key using its TGT. It then uses the session key to decrypt the users timestamp. If the timestamp is within a given window, the ftp service continues the session with the user. The session can be encrypted using the session key. If the timestamp falls outside of the allotted window, the ftp service kills the session.

The Kerberos Pages (the really important ones)