u4.13 Kerberos Security

u4.13 Kerberos Security

1. Kerberos builds on symmetric key cryptography and requires a trusted third party, and optionally may use public-key cryptography during certain phases of authentication. [1] Kerberos uses UDP port 88 by default.

   • Uses DES, AES and Hashing

2. 4 Entities involved in Kerberos

   • Authentication server AS
   • Ticket Granting Server TGS
   • Client C
   • Server S

3. Keys

   • Long term keys shared by
     • AS + TGS
     • AS + C
     • TGS + S
   • Short term Keys shared by
     • C + TGS
     • C + S

4. Other issues

   • Availability
     • Kerberos needs an on-line AS and TGS, if they are unavailable no one can authenticate
   • Scalability
     • Max size is limited by the capacity of the AS and TGS to respond to requests
   • Revocation
     • if a ticket is compromised during its 10 hr lifetime there is no mechanisim for revoking it
   • Synchronous clocks
     • required for any authentication protocol and must be protected