1@node What is Kerberos?, Building and Installing, Introduction, Top 2@chapter What is Kerberos? 3 4@quotation 5@flushleft 6 Now this Cerberus had three heads of dogs, 7 the tail of a dragon, and on his back the 8 heads of all sorts of snakes. 9 --- Pseudo-Apollodorus Library 2.5.12 10@end flushleft 11@end quotation 12 13Kerberos is a system for authenticating users and services on a network. 14It is built upon the assumption that the network is ``unsafe''. For 15example, data sent over the network can be eavesdropped and altered, and 16addresses can also be faked. Therefore they cannot be used for 17authentication purposes. 18@cindex authentication 19 20Kerberos is a trusted third-party service. That means that there is a 21third party (the kerberos server) that is trusted by all the entities on 22the network (users and services, usually called @dfn{principals}). All 23principals share a secret password (or key) with the kerberos server and 24this enables principals to verify that the messages from the kerberos 25server are authentic. Thus trusting the kerberos server, users and 26services can authenticate each other. 27 28@section Basic mechanism 29 30@ifinfo 31@macro sub{arg} 32<\arg\> 33@end macro 34@end ifinfo 35 36@tex 37@def@xsub#1{$_{#1}$} 38@global@let@sub=@xsub 39@end tex 40 41@ifhtml 42@macro sub{arg} 43<\arg\> 44@end macro 45@end ifhtml 46 47@quotation 48@strong{Note:} This discussion is about Kerberos version 4, but version 495 works similarly. 50@end quotation 51 52In Kerberos, principals use @dfn{tickets} to prove that they are who 53they claim to be. In the following example, @var{A} is the initiator of 54the authentication exchange, usually a user, and @var{B} is the service 55that @var{A} wishes to use. 56 57To obtain a ticket for a specific service, @var{A} sends a ticket 58request to the kerberos server. The request contains @var{A}'s and 59@var{B}'s names (along with some other fields). The kerberos server 60checks that both @var{A} and @var{B} are valid principals. 61 62Having verified the validity of the principals, it creates a packet 63containing @var{A}'s and @var{B}'s names, @var{A}'s network address 64(@var{A@sub{addr}}), the current time (@var{t@sub{issue}}), the lifetime 65of the ticket (@var{life}), and a secret @dfn{session key} 66@cindex session key 67(@var{K@sub{AB}}). This packet is encrypted with @var{B}'s secret key 68(@var{K@sub{B}}). The actual ticket (@var{T@sub{AB}}) looks like this: 69(@{@var{A}, @var{B}, @var{A@sub{addr}}, @var{t@sub{issue}}, @var{life}, 70@var{K@sub{AB}}@}@var{K@sub{B}}). 71 72The reply to @var{A} consists of the ticket (@var{T@sub{AB}}), @var{B}'s 73name, the current time, the lifetime of the ticket, and the session key, all 74encrypted in @var{A}'s secret key (@{@var{B}, @var{t@sub{issue}}, 75@var{life}, @var{K@sub{AB}}, @var{T@sub{AB}}@}@var{K@sub{A}}). @var{A} 76decrypts the reply and retains it for later use. 77 78@sp 1 79 80Before sending a message to @var{B}, @var{A} creates an authenticator 81consisting of @var{A}'s name, @var{A}'s address, the current time, and a 82``checksum'' chosen by @var{A}, all encrypted with the secret session 83key (@{@var{A}, @var{A@sub{addr}}, @var{t@sub{current}}, 84@var{checksum}@}@var{K@sub{AB}}). This is sent together with the ticket 85received from the kerberos server to @var{B}. Upon reception, @var{B} 86decrypts the ticket using @var{B}'s secret key. Since the ticket 87contains the session key that the authenticator was encrypted with, 88@var{B} can now also decrypt the authenticator. To verify that @var{A} 89really is @var{A}, @var{B} now has to compare the contents of the ticket 90with that of the authenticator. If everything matches, @var{B} now 91considers @var{A} as properly authenticated. 92 93@c (here we should have some more explanations) 94 95@section Different attacks 96 97@subheading Impersonating A 98 99An impostor, @var{C} could steal the authenticator and the ticket as it 100is transmitted across the network, and use them to impersonate 101@var{A}. The address in the ticket and the authenticator was added to 102make it more difficult to perform this attack. To succeed @var{C} will 103have to either use the same machine as @var{A} or fake the source 104addresses of the packets. By including the time stamp in the 105authenticator, @var{C} does not have much time in which to mount the 106attack. 107 108@subheading Impersonating B 109 110@var{C} can hijack @var{B}'s network address, and when @var{A} sends 111her credentials, @var{C} just pretend to verify them. @var{C} can't 112be sure that she is talking to @var{A}. 113 114@section Defense strategies 115 116It would be possible to add a @dfn{replay cache} 117@cindex replay cache 118to the server side. The idea is to save the authenticators sent during 119the last few minutes, so that @var{B} can detect when someone is trying 120to retransmit an already used message. This is somewhat impractical 121(mostly regarding efficiency), and is not part of Kerberos 4; MIT 122Kerberos 5 contains it. 123 124To authenticate @var{B}, @var{A} might request that @var{B} sends 125something back that proves that @var{B} has access to the session 126key. An example of this is the checksum that @var{A} sent as part of the 127authenticator. One typical procedure is to add one to the checksum, 128encrypt it with the session key and send it back to @var{A}. This is 129called @dfn{mutual authentication}. 130 131The session key can also be used to add cryptographic checksums to the 132messages sent between @var{A} and @var{B} (known as @dfn{message 133integrity}). Encryption can also be added (@dfn{message 134confidentiality}). This is probably the best approach in all cases. 135@cindex integrity 136@cindex confidentiality 137 138@section Further reading 139 140The original paper on Kerberos from 1988 is @cite{Kerberos: An 141Authentication Service for Open Network Systems}, by Jennifer Steiner, 142Clifford Neuman and Jeffrey I. Schiller. 143 144A less technical description can be found in @cite{Designing an 145Authentication System: a Dialogue in Four Scenes} by Bill Bryant, also 146from 1988. 147 148These documents can be found on our web-page at 149@url{http://www.pdc.kth.se/kth-krb/}. 150