Kerberos

Created by MIT. A Single Sign On authentication protocol used while the user is logged in. Grants them tickets for the current session.

• Uses Symmetric Encryption.
• Ensures packets are encrypted for authentication.
• Protects against MITM and Replay Attack.

Protocol

We want host $A$ to talk to file server $B$

1. Assumed shared key both Authentication Server and host knows (could be host’s password in AD)
2. Request a ticket from kerberos server to get TGT
   1. Send a request to talk to Ticket Granting Server, pass in $n_a$
3. KDC returns a message that is Encrypted with a session ticket $K_{as}$ containing:
   1. Shared symmetric key $K_{at}$
   2. $n_a$ random number to stop Replay Attack
   3. $T$ time
   4. $L$ lifespan
   5. id TGS
4. KDC returns the TGT containing:
   1. Shared symmtric key $K_{at}$
   2. id $A$
   3. $L$ lifespan
5. Host $A$ sends request to talk to fileserver $B$
   1. Host sends request encrypted with $K_{at}$:
      1. id $A$
      2. $T_a$ time
      3. id $B$
      4. $n_a$ random number to stop Replay Attack
   2. Host sends TGT
6. TGS returns a new ticket to talk to the server $B$ encrypted with $K_{at}$ containing:
   1. $K_{ab}$ shared key
   2. $n_a$ random number
   3. $T_t$ time
   4. $L$ lifespan

Concepts

• Key Distribution Center
  • Authentication Server
  • Ticket Server
• Kerberoasting Attack
• Kerberos SSO Process
• Ticket Granting Ticket
• USN
• Mutual Authentication
• ntds