Exam - Kerberos - created from Mind Map

Page 1

principals & their roles

A Kerberos principal is a unique identity to which Kerberos can assign tickets. Principals can have an arbitrary number of components: the primary, the instance and the realm.

format typically: primary / instance @ realm

applications

Campus network where access to various resources (printing, file storage (SMB), computing time, proxy authentication, authorisation) needs to be controlled for a population of users, but where the servers do not necessariyl know about (or trust) the users.

weaknesses

availability

scalability

revocation

time synchronization reliance

TGT lifetime

Kerberos has a single point of failure at the authentication server or the ticket granting server.

Kerberos systems can only scale to support as much as the central authentication and/ or TGT servers can handle.

Ticket granting tickets are good for 10 hours. If a ticket is compromised, there is no mechanism to revoke the ticket.

Clocks on the network cannot be more than 5 minutes out of sync for Kerberos to work.

The relatively long life and the fixed structure of the TGT opens the door for offline attacks to figure out the encryption key. In Kerberos version 4, the encrpytion algorithm was DES which can be compromised today.

entities

authentication server

ticekt granting server

client

server

ahthentication and key exchange

HIGH LEVEL! For exam detail see shared notes!!

Exam - Kerberos