Q20Information Security Systems
Question
Describe the Kerberos authentication protocol in detail. Explain the roles of the Authentication Server (AS) and Ticket Granting Server (TGS).
Answer
Kerberos is a secure, ticket-based authentication protocol for untrusted networks.
Kerberos is a widely utilized network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. It assumes network communication is inherently insecure. The architecture centers on a trusted third party known as the Key Distribution Center (KDC).
The KDC consists of two primary logical components: the Authentication Server (AS) and the Ticket Granting Server (TGS). The workflow proceeds as follows:
1. Initial Authentication: The client requests a Ticket Granting Ticket (TGT) from the AS. The AS authenticates the client using their password hash and returns an encrypted TGT and a session key.
2. Requesting a Service Ticket: The client wishes to access a specific network service. The client presents the TGT and an authenticator to the TGS. Since the TGT is encrypted with the TGS's secret key, it proves the client's initial authentication.
3. Service Access: The TGS validates the TGT and issues a Service Ticket valid for the requested service. The client then sends this Service Ticket to the target Application Server to gain access.
Kerberos effectively mitigates replay attacks using timestamps and avoids transmitting plain text passwords over the network.
