This document discusses the Kerberos authentication protocol. It provides a high-level overview of Kerberos, including its history, terminology, working, environment, database, and administrator. Kerberos provides strong authentication for physically insecure networks using trusted third parties and time-stamped tickets. While it ensures passwords are not sent in the clear, Kerberos is vulnerable if users choose poor passwords and relies on all machines being designed for its authentication.

1. ”KERBEROS”
Sameer Farooq
Reg_No: 11501907
M.tech (CSE)
.
Dept.of Computer Science& Engineering
Lovely Professional University
Phagwara, Jalandhar-144401

2. CONTENTS
 WHAT IS KERBEROS?
 HISTORY.
 TERMINOLOGY.
 WORKING.
 KERBEROS ENVIRONMENT.
 KERBEROS DATABASE.
 KERBEROS ADMINISTRATOR.
 ADVANTAGES & DISADVANTAGES.
 PUBLIC KEY CRYPTOGRAPHY.
 CONCLUSION.
 REFERENCES.

3. Whatis Kerberos ?
• Network authentication protocol.
• Developed at MIT in the mid 1980s.
• Uses trusted 3rd party authentication scheme.
• Assumes that hosts are not trustworthy.
• Requires that each client (each request for service) prove it’s identity.
• Does not require user to enter password every time a service is
requested !.

4. History
• Steve Miller and Clifford Neuman designed the primary Kerberos version in1983.
• Versions 1–3 occurred only internally at MIT as part of project Athena.
• Windows 2000 was Microsoft's first system to implement Kerberos security
standard.
• Version 5, designed by John Kohl and Clifford Neuman, appeared in 1993 .

5. Recent updates include:-
• Encryption and Checksum Specifications.
• Clarification of the protocol with more detailed and clearer explanation
of intended use.
• A new edition of the GSS-API( Generic Security Service Application
Program Interface ) specification.

6. Why Kerberos ?
• Sending usernames and passwords in the clear jeopardizes the
security of the network.
• Each time a password is sent in the clear, there is a chance for
interception.
Provides
• strong security on physically insecure network.
• a centralized authentication server which authenticates
• Users to servers.
• Servers to users.

7. Firewall vs. Kerberos ?
• Firewalls make a risky assumption: that attackers are coming from the
outside. In reality, attacks frequently come from within.
• Assumes “bad guys” are on the outside….while the
really damaging ones can be inside !.
• Restrict use of Internet.
• Kerberos assumes that network connections (rather than servers and
work stations) are the weak link in network security.

8. TERMINOLOGY
 Realm:
Indicates an authentication administrator domain.
 Principal:
It is the name used to refer to the entries in AS.
 Ticket:
It is issued by AS & Encrypted using Secret key of Service.
 Encryption:
 Encryption type:
DES, RC4-HMAC, AES128 &AES256 algorithms.
 Encryption key.
 Key Version Number (kvno)

9.  Key Distribution Center (KDC):
 Database:
Contains information about Users & Services.
 Authentication Server (AS):
Give reply to initial authentication Request from Client & issues
TGT.
 Ticket Granting Server (TGS):
Distributes Service tickets to client.
 Session Key:
It is secret between Users & Services for which a client has work session open
on a server.
 Replay Cache
 Credential Cache:
Used to store password & related session key.

10. Fig. 1 Authentication service verifies the user ID
Working of Kerberos
Step 1: (Fig 1)
The AS, receives the request
by the client and verifies that the
client.

11. Fig. 2 Authentication service issues TGT.
Step 2:
 Upon verification, a timestamp is
created with current time in a user
session with expiration date.
 The timestamp ensures that when
8 hours is up, the encryption key is
useless.
Step 3: (Fig 2)
The key is sent back to the
client in the form of a TGT.

12. Fig. 3 Client submits TGT to TGS.
Step 4: (Fig 3)
The client submits the TGT
to the TGS, to get authenticated.

13. Fig. 4 TGS grants client the service ticket.
Step 5: (Fig. 4)
 The TGS creates an encrypted
key with a timestamp and grants
the client a service ticket.
Step 6:
 The client decrypts the ticket &
send ACK to TGS.

14. Fig. 5 Service server decrypts key & checks timestamp
Step 7:
 Then sends its own encrypted
key to the service server.
 The service decrypts the
key and check timestamp is
still valid or not.
 If it is, the service contacts
the KDC to receive a session
that is returned to the client.

15. Fig. 6 For valid keys communication is initiated.
Step 8: (Fig. 6)
 The client decrypts the ticket.
If the keys are still valid , comm-
-unication is initiated between client
and server.
 Now the client is authenticated
until the session expires.

16. Kerberos Environment
Fig. 7 A possible Kerberos environment
 First, Kerberos infrastructure
contain at least one Kerberos
Server.
 The KDC holds a complete
database of user and service
keys.
 Second, Kerberos-enabled
clients and services called
kerberized clients and services.
1. Typical Infrastructure(Fig. 7)
2. Kerberized Services

17. Kerberos Database
Fig. 8 Authentication Requests.
 Kerberos operations requires both
read only and write access is done
through Kerberos database.
 From figure operations requiring read-
only access to the Kerberos database are
performed by the AS(KDBM), which
can run on both master and slave M/c.

18.  From figure we may say that
changes may only be made to the
Master Kerberos database where
Slave copies are read-only.
 Therefore, the KDBM server may
only run on the master Kerberos M/c.
Fig. Administration Requests.

19. Kerberos Administrator
 It manages and controls all the Operations & Functions of Kerberos.
 Running a program to initialize database.
 Register essential principals in the database.
 Kerberos administration server and AS must be started up properly.
 For new Kerberos application ,it must take few steps to get it working.
 It must be registered in the database
 Assigned a private key
 It must also ensure that Kerberos machines are physically secure & also
able to maintain backups of the Master database.

20.  Advantages:
 Passwords are never sent across the network unencrypted.
 Clients and applications services mutually authenticated.
 Tickets have a limited lifetime.
 Authentication through the AS only has to happen once.
 Sharing secret keys is more efficient than public-keys.
 Disadvantages:
 Kerberos only provides authentication for clients and services.
 Vulnerable to users making poor password choices.
 Client M/c and service(servers) M/c to be designed with Kerberos authentication in
mind.

21. PUBLIC KEY CRYPTOGRAPHY
 In Public Key Cryptography two different but mathematically related keys are
used.
 The public key may be freely distributed, while its paired private key must
remain secret.
 The public key is typically used for encryption, while the private or secret key is
used for decryption.
 It give new direction to Kerberos as it eases key distribution a lot.
 KDC doesn’t need to save client keys in its database.
 To obtain a TGT, the client has to present his public key.
 A trusted certification authority (CA) has to sign every valid public key.

22. CONCLUSION
 Researched and developed for over 8 years.
 Kerberos doesn’t fail to deliver services.
 Ex:- Cisco, Microsoft, Apple, and many others.
 As authentication is critical for the security of computer systems, traditional
authentication methods are not suitable for use in computer networks
 The Kerberos authentication system is well suited for authentication of users in
such environments.

23. REFERENCES
 Computer Networking by James Kurose and Keith Rose.
 Kerberos: Network Authentication System by Brain Pung.
 Introduction to Kerberos technology.
 http://web.mit.edu/Kerberos/
 http://searchsecurity.techtarget.com/sDefinition/
 http://www.google.co.in/