Kerberos :

• Many real life systems use an authentication protocol called as 'Kerberos'.

• The 'Needham-shroeder ' protocol is the basis of Kerberos

• Version 4 of Kerberos is found in most practical implementations. However version 5 is also in use new.

Working of Kereberos

There are four parties involved in this protocol:

a. Alice: The client workstation

b. Authentication server (AS): verifies and authenticate new user during login

c. Ticket granting server (TGS): Issue tickets to certify proof of identity.

d. Bob: The server offering services such as network printing , file sharing as an application program.

• The job of AS is to authenticate every user at the login time AS shares a unique secret password with every user.

• The job of TGS is to certify to the servers in the network that a user is really what she claims to be for proving this, the mechanism of tickets ( which allows entry into a server, just as a ticket allows parking a car or entering a music concert) is used.

• These are there primary steps in the Kerberos protocol.

Step-1:Login

• User A sends his name in plain text to AS i.e. A sends login request to AS

• In response, the AS performs several actions.

• It first creates a package of the username (A) & a randomly generated session Key (KS)

• It encrypts this package with the symmetric key that the AS shares with the ticket granting server (TGS).

• The output of this step is called as the Ticket Granting Ticket (TGT) (TGT can only be opened by the TGS as only it possesses the corresponding symmetric key for decryption.

• The AS then combines the TGT with the session key (KS) & encrypt the two together using a symmetric key derived from the password of 'A' & thus final output can only be opened by 'A'.

• After this message is received 'A's workstations asks for his password.

• When 'A' enters it, the workstations generates the symmetric key (KA) derived from the password & uses that key to extract the session key (KS) & the Ticket Granting Ticket.

• The work station destroys the password of alive from its memory immediately, to prevent an attack fro, starting it.

Step-2: Obtaining a service granting ticket (SGT)

• After successful login 'A' wants to make use of 'B' - the email server , for same email communication.

• For this A will inform his workstation that he needs to contact 'B'.

• Therefore, A needs a ticket to communicate with B. At this junction A's workstations creates a message intended for the Ticket Granting Server (TGS), which contains the following items.

a. The TGT as in step 1.

b. The it of the server B whose service A is interested in.

c. The current timestamp encrypted with the same session key (KS).

• Once the TGS is satisfied of 'A' the TGS creates a session key KAB, for A to have secure communication with B.

• TGS sends it twice A once combined with A's id & encrypted with the session key (KS) & a second time , combined wit A id encrypted with B's secret key (KB).

Step-3: User contacts 'B' for accessing the server

• 'A' can now send KAB to B in order to enter into a session with him.

• For secure communication , A can simply forward KAB encrypted with B's secret key which he had received from TGS in the step to B.

• This ensure that only B can access KAB.

• To guard against replay attacks , A sends the timestamp, encrypted with KAB to Bob.

• As only B has his secret key , he uses it to first obtain the information ( A + KAB) from this it gets the encrypted timestamp value.

• To ensure that B received KAB correctly or not, B now adds 1 to the timestamp & sent by A, encrypts the result with KAB sends it back to Alice.

• Since only A & B knows KAB, A can open this packet & verify that the timestamp incremented by B was indeed the one sent by him to B in the first place.

• Now A & B can communicate securely with each other. They would use the shared secret key KAB to encrypt messages before sending & also to decrypt the encrypted messages received messages received from each other.