U4.11 Kerberos & Windows NW Auth

U4.11 Kerberos & Windows NW Auth

1. Also a trusted 3rd party protocol

   • Designed so workstations / clients / servers to authenticate to one another
     • Also to control client access to network services

2. Authentication server

   • Authenticates clients

3. Ticket granting server

   • distributes session keys

4. Protocol in a 3 Stage Process

   • Stage 1
     • Authentication Server (AS) conducts an auth protocol with the client based on a long term key they share
     • The authentication gives the client a key to be used in subsequent communications and an encrypted copy of the key
     • This is the short term key and the encrypted copy is a ticket granting ticket
   • Stage 2
     • Short term key and ticket granting ticket are then used by the client to communicate with the ticket granting server
     • The client and the TGS use the short term key to authenticate to one another. In this stage the client also requests access to a particular resource on a particular server on the network
     • The TGS is responsible for deciding if access is granted or not
     • If the TGS decision is positive the request is answered with a session key & an encrypted copy of the session key called a service ticket
   • Stage 3
     • Now the client has a session key and service ticket for a server.
     • Client presents the service ticket and the client and server use the session key to authenticate one another
     • If the authentication is successful then the client is granted access to the server

5. Advantage

   • See ski resort analogy pg 29
   • Dividing the initial client auth from issuing of service tickets means sensitive long term keys shared between the client and the AS are only used to protect a minimum amount of traffic
     • They last for 1 10hr session, then deleted from memory
       • This reduces the risk of exposure
         • Tickets only last 5 minutes limiting the damage that an attacker who captures tickets can do