The document outlines the components and functioning of the Key Distribution Center (KDC) in the Kerberos authentication protocol, including principles like ticket granting services and session ticket usage. It details the process of user authentication, ticket creation, and the importance of shared secret keys for secure communication. Additionally, it addresses security concerns such as single points of failure, key theft, and the need for time synchronization across machines.

2. Main components
KDC(Key Distribution Center)
• Holds secret keys for users
and services.
• Authentication service.
• Key distribution service.
• Clients(users, services and
machines) trust its integrity,
which is the basis of Kerberos
security.
Principals.
• Users, applications, network
services.
• KDC must have an account
for and share a secret key
with principal.
• For users shared secret key is
their password.
• This Shared secret key is used
to encrypt data which is
exchanged between KDC and
Principal.
• This key is also used for
authentication.
Ticket.
• TGT: A ticket is granted by
TGS(Ticket granting service)
given to principal.
• When this principal(user,
application or service) needs
to authenticate to another
principal.
• This ticket allows this
principal to get that session
ticket to authenticate to the
other principal.
Realm
• Group of principals.
• KDC is the trusted
authentication server for all
the principals in the realm.
• One KDC is responsible for
one or more realms.
• Realms are used to logically
group resources.

3. AS
TGS
1
2
3
4
5
1. User Authenticates to AS(Authenticating Service).
2. AS sendsTGT(Ticket GrantingTicket) to user.
3. User requests to access file server along withTGT.
4. TGS (Ticket Granting Service)creates session ticket
using session keys(two instances of same session
key,one encrypted with password of user, second
encrypted with password of file server).
5. User sends file access request to File server using
session ticket.
User
KDC
File Server

4. Zoom in -logon and AS
When user logs on to his machine, he enters username and password.
Machine on behalf of User requests authentication by sending a timestamp (Pre-auth data)
encrypted with the user’s password(password hash). (Kerberos AS-REQ)
KDC which has its own database of principals, finds out the password of this username and uses
this password to decrypt the(Pre-auth data) and createTGT for the user(KerberosAS-REP)
ThisTGT is sent to the user machine.They most important point is thisTGT is encrypted using
password hash of krbtgt account of KDC

5. Access another principal :
Session ticket(using Symmetric keys)
If this user who has logged
on to the machine and got
TGT from KDC wants to
access File server.
This user’s machine will
sendTGT toTGS(Ticket
Granting Service)of KDC
along with request to
access file server.
TGS creates another ticket
that user will use to
authenticate to file server.
• This ticket has two instances of
same session key.
• One instance of this session key
is encrypted with user’s
password(shared secret key).
• Second instance of session key
is encrypted with file server’s
password (shared secret key)
• This ticket also has authenticator
: contains identification
information of the user, user’s
machine’s IP address, sequence
number and a time stamp.

6. Session ticket usage
After user’s machine receives the ticket, it decrypts and extracts the session key that was encrypted using user’s shared
key(user’s password).
User’s machine encrypts the second authenticator set with this session key and then adds this to the ticket and then
forwards this ticket to File server.
File server decrypts the session key using its password(shared secret key).
File server then decrypts the second authenticator set added by user machine.
It then compares the authenticator information added by KDC with authenticator information added by client machine
If both are same user is authenticated by file server.

7. Contents of Authenticator
User’s Identification information.
Time stamp.(used to avoid replay attacks) its of 5 seconds in windows
environment ,so this authentication should happen within this period
else its unusable.
Sequence number(used to see if this same ticket was used before)

8. Security Concerns
Single point of failure,
redundancy should be
maintained to
overcome this.
Scalability, to handle
the load.
Secret keys are stored
temporarily on the
user machine, which
can be stolen.
Session keys are also
stored on machines
and they can be stolen
too.
Password attacks can
happen on it.
All client and server
machines should be
time synced.