[ Home | Class Roster | Syllabus | Status | Glossary | Search | Course Notes]
Third party authentification:
Private key, DES standard based
Only server and user know the user's private key
Uses session keys to set up conversations between parties
Uses timestamps to detect replays
Uses tickets to request service
Phase I: Getting the initial ticket
User-authentication protocol
Requesting process sends its userid U to client C
C send U and name of ticket granting service (tgs) to the Kerberos server K
K retrieves user key Ku and tgs key Ktgs from database and generates a session key Ku,tgs
K creates a ticket Tu,tgs = Ektgs{U,tgs,Ku,tgs,timestamp,life}
Ktgs known only to Kerberos and the Ticket granting service
K sends this ticket to the client C in the message
Eku{Tu/tgs,Ku/tgs,tgs,timestamp,life)
C asks user process for password.
Applies one-way function to password to get K'u
Decrypts message from K using K'u
Phase II: Getting the server ticket
C sends request for service to TGS with
name of server S
ticket granting ticket
authenticator Au = Eku/tgs{C,timestamp}
tgs decrypts ticket to get session key Ku.tgs
Uses session key to decrypt authenticator
TGS creates a new session key Kc/s
builds ticket Tc/s=Eks{C,S,Kc/s,timestamp,life}
(encrypted with server key)
sends Eku/tgs{Tc/s, Kc/s,S,timestamp,life} to C
C decyrypts to obtain new session key and ticket
PhaseIII: Requesting the service
C builds authenticator Ac=Ekc/s{C,timestamp}
sends Ac and Tc/s to S
service decrypts ticket to get session key
using session key decrypts authenticator
FOr reverse authentication, S adds one to timestamp
encrypts using session key and sends to client Ekc/s(timestamp+1)
See slides (click for powerpoint version)