Kerberos Protocol.pdf

Kerberos is a protocol for secure authentication involving several steps between the client, Authentication Server (AS), Ticket Granting Server (TGS), and Service Server (SS).

1. The user enters their username and password on the client.
2. A one-way hash of the password becomes the client's secret key.
3. The client requests services from AS without sending the secret key or password.
4. If recognized, AS sends two messages: a session key encrypted with the user’s secret key (Message A) and a Ticket-Granting Ticket encrypted with TGS's secret key (Message B).
5. The client uses Message A to obtain the client/TGS session key for further communication with TGS.
6. To request services, the client sends the Ticket-Granting Ticket and an authenticator encrypted with the client/TGS session key (Messages C and D) to TGS.
7. TGS decrypts the authenticator and responds with a client-to-server ticket and a client/server session key (Messages E and F).
8. The client uses these messages to authenticate itself to SS, sending the client-to-server ticket and a new authenticator encrypted with the client/server session key (Messages G and H).
9. SS decrypts the ticket and sends back an updated timestamp encrypted with the client/server session key (Message I) to confirm identity.
10. The client verifies the timestamp update to trust the server, allowing service requests.
11. The server provides requested services to the client.