Course Code: CSE 606 
Course Title: Cryptography & Information Security 
 
 
 
 
Assignment On : 
Describe the use of Kerberos and explain the role 
of authentication server and ticket granting server 
of Kerberos. 
 
 
 

Submitted By:
Mohammad Nazmul Haque
ID: 101-25-149
M.Sc in CSE

SUBMITTED TO:
PROFESSOR DR. M. LUTFAR RAHMAN
DEAN
FACULTY OF SCIENCE AND INFORMATION TECHNOLOGY
DAFFODIL INTERNATIONAL UNIVERSITY
Describe the use of Kerberos and explain the role of
authentication server and ticket granting server of
Kerberos. List applications of Kerberos.

Kerberos is a network authentication protocol. It is designed to provide strong

authentication for client/server applications by using secret-key cryptography.

The Internet is an insecure place. Many of the protocols used in the Internet do not
provide any security. Tools to "sniff" passwords off of the network are in common use by
malicious hackers. Thus, applications which send an unencrypted password over the
network are extremely vulnerable. Worse yet, other client/server applications rely on the
client program to be "honest" about the identity of the user who is using it. Other
applications rely on the client to restrict its activities to those which it is allowed to do,
with no other enforcement by the server [1].

Some sites attempt to use firewalls to solve their network security problems.
Unfortunately, firewalls assume that "the bad guys" are on the outside, which is often a
very bad assumption. Most of the really damaging incidents of computer crime are
carried out by insiders. Firewalls also have a significant disadvantage in that they restrict
how your users can use the Internet. (After all, firewalls are simply a less extreme
example of the dictum that there is nothing more secures then a computer which is not
connected to the network --- and powered off!) In many places, these restrictions are
simply unrealistic and unacceptable [1].

Kerberos was created by MIT as a solution to these network security problems. The
Kerberos protocol uses strong cryptography so that a client can prove its identity to a
server (and vice versa) across an insecure network connection. After a client and server
have used Kerberos to prove their identity, they can also encrypt all of their
communications to assure privacy and data integrity as they go about their business [2].

Kerberos at a Glance

Kerberos operates by encrypting data with a symmetric key. A symmetric key is a type of
authentication where both the client and server agree to use a single
encryption/decryption key for sending or receiving data. When working with the
encryption key, the details are actually sent to a key distribution center, or KDC, instead
of sending the details directly between each computer [3,4].

The client authenticates itself to the Authentication Server and receives a ticket. (All
tickets are time-stamped.) It then contacts the Ticket Granting Server, and using the ticket
it demonstrates its identity and asks for a service. If the client is eligible for the service,
then the Ticket Granting Server sends another ticket to the client. The client then contacts
the Service Server, and using this ticket it proves that it has been approved to receive the
service [3].

Figure 1: Kerberos servers [3]

Role of Authentication Server (AS): AS is the KDC in Kerberos protocol. Each user
registers with AS and is granted a user identity and a password. AS has a database with
these identities and the corresponding passwords. AS verifies the user, issues a session
key to be used between Alice and TGS, and sends a ticket for TGS [1,2,3].

Figure 2: Request for Authentication

The authentication service, or AS, receives the request by the client and verifies that the
client is indeed the computer it claims to be. This is usually just a simple database lookup
of the user’s ID [2,3].
 Figure 3: AS send back Ticket Granting Ticket

Upon verification, a timestamp is created. This puts the current time in a user session,
along with an expiration date. The default expiration date of a timestamp is 8 hours. The
encryption key is then created. The timestamp ensures that when 8 hours is up, the
encryption key is useless. (This is used to make sure a hacker doesn’t intercept the data,
and try to crack the key. Almost all keys are able to be cracked, but it will take a lot
longer than 8 hours to do so) [4].

Role of Ticket-Granting Server (TGS): TGS issues a ticket for the real server (Bob). It
also provides the session key (KAB) between Alice and Bob. Kerberos has separated the
user verification from ticket issuing. In this way, although Alice verifies her ID just once
with AS, she can contact TGS multiple times to obtain tickets for different real servers.

The key is sent back to the client in the form of a ticket-granting ticket, or TGT. This is
a simple ticket that is issued by the authentication service. It is used for authenticating the
client for future reference.

Figure 4: Client sends Ticket to TGS to get authenticated

The client submits the ticket-granting ticket to the ticket-granting server, or TGS, to get
authenticated [4].
 Figure 5: TGS grants the client a service ticket

The TGS creates an encrypted key with a timestamp, and grants the client a service ticket.

Applications of Kerberos

• Email, FTP, network file systems and many other applications can be used
Kerberos in transparent for the end user.
• Local authentication in OS.
• Authentication for network protocols.
• Secure windowing systems.
• Securing Ecommerce applications.
• Providing security in e-government applications.

In summary, Kerberos is a solution to network security problems. It provides the tools of

authentication and strong cryptography over the network to help secure the information
systems across entire enterprise [6,7].

Discussion

Nothing is perfect. Kerberos has a couple of main flaws that system administrators need
to take into account.

First and foremost is the need of the Kerberos server. This server will handle all the
functions required for authentication. If this server goes down, no one can get
authenticated, and thus- the network is down. A total network crash can be prevented by
using more than one Kerberos server, but that is more costly than some people would like
to think.

Next, we have the issue of clock synchronization. Since Kerberos uses timestamps to
handle all activity, the clocks on all host machines must be within 10 minutes of the
Kerberos server’s clock. Since not all clocks are perfect, the host clock and server clock
will eventually be misaligned enough to cause a failure.

Ticket hijacking is another issue where Kerberos fails. Malicious user may steal the
service ticket of another user on the same workstation and use it. IP address verification
does not help in this regard. Servers must verify that the user who is presenting the ticket
is the same user to whom the ticket was issued.

Reference:

1) R. Uma Rani , A System to Enhance Security in Kerberos Authentication System,

http://www.securitydocs.com/library/3004, 02/11/2005.
2) Data and Computer Communications, Seventh Edition, by William Stallings
3) Cryptography and Network Security, By Behrouz A. Forouzan
4) http://learn-networking.com/network-security/how-kerberos-authentication-works
5) http://web.mit.edu/kerberos/
6) http://en.wikipedia.org/wiki/Kerberos_%28protocol%29
7) http://www.topbits.com/what-is-kerberos.html