U4.12 Kerberos Messages

U4.12 Kerberos Messages

1. Stage 1

   • 1. Client initiates protocol with Auth Server
     • They use a long term key
     • Client requests a ticket granting ticket (TGT) for use in stage 2
   • 2. The AS reply to the client auth request ha 2 parts
     • A. Includes text encrypted by a key shared by the AS and the ticket granting server TGS
       • This part is the TGT
         • it tells the TGS the clients identity, validity period for TGT and the short term key
       • Only the TGS can decrypt to get contents
     • B. Text encrypted by the long term key shared between the AS and client
       • This authenticates the AS to the client
       • Also contains the short term key in such a form only the the client can access it

2. Stage 2.

   • 4. TGS issues Session key and Service ticket to C
     • Contains in encrypted form info telling the server the clients identity, validity period of the service ticket and a session key
     • TGS is authenticated to C
   • 3. Client and TGS use short term key to mutually authenticate
     • they derive a session key and a service ticket
     • Client presents a request for access to server along with TGT

3. Stage 3

   • Session key is used to secure any further communications between C and S
   • 5. C presents service ticket to S
     • C and S use session key and the service ticket to mutually authenticate one another
       • Success grants C access to S

4. Nonces are used in all messages for freshness

Images and files in the map