Network Authentication Standards

Kerberos

ü Kerberos designed at MIT and it is name of a 3 headed dog!

ü It is a secret key based service for providing authentication in a network.

ü Some applications that uses Kerberos: telnet, rsh and NFS.

Ø Master Keys and Session Keys:

· The KDC shares a secret key, called the master key, with each principle

(each user and each resource).

Alice's master key K_A is derived from her password.

· The workstation asks the KDC for a limited-lifetime session key S_A

The KDC sends the workstation:

K_A{S_A} & a ticket-granting ticket TGT =  K_kdc {T}

T contains: Alice's name, S_A and expiration time.
K_kdc is the he KDC master key.

· The workstation: forgets Alice's K_A and remembers S_A and the TGT.

This is illustrated as:

{======================================

Alice  workstation KDC
Alice, passwd >
   Alice needs a TGT  >
< K_A{S_A}, TGT=K_kdc {T}

======================================}

Whenever Alice needs to talk to Bob

ü Her workstation sends the TGT to the KDC.

ü The KDC generates K_AB and send to the workstation:
S_A{K_AB} &  a ticket to Bob = K_B{ "Alice", K_AB}

ü Her workstation sends this ticket to Bob along with an

ü authenticator K_AB {t}, where t  is the current time to prove to Bob that she knows K_AB
(Kerberos allows up to 5 minutes skew between clocks).

ü Bob sends back K_AB {t+1} to prove that he is indeed Bob (since he must knows _KB to find out _KAB ).

ü Thereafter, messages between Alice and Bob may be encrypted and integrity protected using K_AB

This is illustrated as:

{=================================================

Alice  workstation KDC Bob

wants Bob >
Alice wants Bob, TGT  >

< S_A{"Bob", K_AB , ticket to Bob}

ticket to Bob = K_B{ "Alice", K_AB}
ticket to Bob,  K_AB {t} >
< K_AB {t+1}

=================================================}