Kerberos is a network authentication protocol that allows a user to enter his credentials once and receive access to all necessary network resources, without the need to re-authenticate for each one of them. Kerberos offers advanced cryptographic functions using a mutual authentication between the client and the server to protect against man-in-the-middle attacks.
Kerberos, which was developed by MIT (Massachusetts Institute of Technology), has been in use since the 1980s and is covered in RFC 4120. Microsoft has been using Kerberos as its authentication method since Windows 2000, so it is often associated with Windows environments but it is also compatible with other operating systems and devices.
Kerberos has three main components:
- KDC (Key Distribution Center): The KDC checks the valid login credentials and vouches for the user’s identity. It operates on TCP and UDP port 88.
- Authentication Service: This is the component that actually performs the authentication on the network.
- Ticket Granting Service: Kerberos works with internal tickets and this service is the component that manages tickets and provides user access on the different network components.
Next, we will analyze an example in which a user wants to access an application server. Once the user decides to log into the network, he will need to talk with the Authentication Service by sending a login request. During this process, the date and time on the local computer is encrypted using the key that is in the password hash. Since the password hash is not actually sent over the network, it is used as a key to encrypt the date and time instead. For this reason, everyone in the network should use NTP to synchronize their clocks.
The Authentication Service receives the information sent by the user and tries to decrypt the information with the hash of the credentials it has. After it is successfully decrypted, it sends a Ticket Granting Ticket (TGT) back to the user, which includes:
- Client name
- IP address
- Timestamp
- TGT validity period (default 10 hours)
The TGT is encrypted with the KDC secret key so it cannot be decrypted by anyone else. The client will also receive a Ticket Granting Service (TGS) session key, used for communication between the client and the TGS. The TGS is then encrypted with the user’s password hash so he will be able to decrypt it.
Once the client has a ticket that allows access to resources, he will send the ticket and the name of the application server he wants to access to the TGT to request access to that specific server. This particular request is time stamped with the client’s ID and encrypted with the TGS session key (to avoid request spoofing). The TGS will send a response back to the client with the following information:
- A session key to use with the application server (this is also encrypted with the TGS session key)
- A service ticket containing user information and service session key (encrypted with the application server’s secret key)
When the client receives information, he cannot decrypt it so he needs to pass the encrypted service ticket to the application server. The client will also send a time-stamped authentication, encrypted with the service session key. Once the application server receives this information, it begins to decrypt the data to confirm its integrity. The server might send a final message check back to the user to be sure that there is no man-in-the-middle. This is an optional step that is most often deployed in high security environments. Finally, the client receives access to the application server’s resources.
Although the Kerberos authentication process appears complex, it all happens transparently to the user and ensures increased security in accessing network resources.