1. Kerberos Guilin Wang School of Computer Science 03 Dec. 2007

2. Outline ■ Password-based key agreement protocols (Continuing our last lecture). ■ Kerberos authentication protocol.

3. 0. Password-based Protocols ■ In the NS protocol, both parties need to share long- term secrets with the server. For humans, long secret keys are not easy to memorize. ■ One naïve approach is to set long-term secrets as passwords. ■ For example, let K bs =P bs, a password shared btw B and S in the NS protocol.

4. 0. Password-based Protocols ■ However, this approach suffers off-line dictionary attack. ■ That is, an attacker can try each possible P’ to decrypt E P-bs (K, A). If P’ is likely the correct password.

5. 0. Password-based Protocols ■ Off-line dictionary attack works since passwords are short strings with low entropy. ■ Countermeasures: - Enhance the strength of passwords by requiring certain length, format, and randomness. - Combine the password with a security token.

6. 0. Password-based Protocols The following Encrypted Key Exchange (EKE) protocol can resist the off-line dictionary attack: ■ PK is an ephemeral public key generated by A. ■ B transfers K to A by using double encryptions. ■ Why EKE protocol is immune to the off-line dictionary attack?

7. 1. Authentication & Key Exchange ■ The purpose of entity authentication is to prevent impersonation attack. ■ Authentication is important in key exchange. E.g, the DH protocol suffers the MITM attack. ■ Actually, key exchange techniques can also be used to realize authentication. Kerberos is such an example. ■ In the literature, the differences btw authentication and key exchange are not very clear sometimes.

8. 1. Authentication & Key Exchange ■ Key exchange usually requires authentication. Otherwise, you are not sure with whom you are agreeing on a session key. ■ However, authentication does not necessarily involve key exchange. ■ For example, a successful authentication can enable a client to enjoy a service without encryption.

9. 2. Kerberos: What is it? ■ In Greek mythology, Kerberos is the guardian of Hades, a dog with three heads. ■ In security community, Kerberos denotes the distributed authentication protocol developed from MIT's project Athena in 1980s.

10. 2. Kerberos: What is it? ■ Kerberos has been widely accepted in industry. ■ Kerberos has been integrated into Windows and many many versions of Unix systems. ■ Full specification of Kerberos Version 5 is given by a draft Internet Standard RFC 1510. ■ Free source codes for different releases of Kerberos are available at the Kerberos website: http://web.mit.edu/Kerberos/

11. 2. Kerberos: Motivations In this scenario of distributed networks, there exist at least three threats: ■ User impersonation: A dishonest user may pretend to be another user from the same workstation. ■ Network address impersonation: A dishonest user can changes the network address of his/her workstation to impersonate another workstation. ■ Eavesdropping, replay attack, and so on. Attackers may try their best to access network service by mounting different attacks.

12. 2.1 Kerberos: Basic Ideas Kerberos uses symmetric mechanisms to realize entity authentication and key exchange. Basically, Kerberos uses two kinds of credentials: ■ Tickets: Issued by a trusted administration server that shows who is granted to access a specific service. ■ Authenticators: Used to prove the identity of a communicating client.

13. 2.1 Kerberos: Basic Ideas This is similar to the following immigration policy, which allows a foreigner to enter a country: ■ Visa (=tickets in Kerberos): Specifies who is allowed to entry this country for how many days. ■ Passport (=Authenticators in Kerberos): Shows your identity, i.e., who are you.

14. 2.1 Kerberos: Basic Ideas In Kerberos system, there are three kinds of servers: ■ Kerberos authentication server (AS): A centralized trusted authentication server for the whole system, who issues long lifetime tickets. ■ Ticket-granting servers (TGS): Issue short lifetime tickets. ■ Service server S: Provide different service.

15. 2.1 Kerberos: Basic Ideas

16. 2.2 The Protocol Kerberos (Version 5) can be divided into three procedures from the view point of a client: ■ obtaining ticket-granting ticket, ■ obtaining service ticket, and ■ obtaining a concrete service. We now discuss the details.

17. 2.2 The Protocol

18. Here: ■ K_c is derived from the client’s password, which is shared with the AS. ■ K_tgs is a secret key shared btw the AS and the TGS. ■ K_1 is session key that enables the client to authenticate itself to the TGS server.

19. 2.2 The Protocol Here: ■ A1 is an authenticator using K1. ■ K2 is a session key that enables the client to authenticate itself to the server S. ■ Ks is a secret key shared btw the TGS and a server S.

20. 2.2 The Protocol Here: ■ A1 is an authenticator using K2. ■ K3 is a session key for coming secure communications. ■ The server S authenticates itself to the client in step 6.

21. 2.3 Kerberos: Its Limitations ■ Single Failure Problem: If the AS is down, no user can access any resources. So Kerberos is prone to denial-of-service (DoS) attacks. - Duplicated AS? Possible, but not easy to maintain. ■ Clock Synchronization is needed, since timestamps are used. Reasonable time interval for clock skew? - Too short: Rejecting many valid requests. - Too long: Suffering replay attack.

22. 2.3 Kerberos: Its Limitations ■ Limited Scalability: Usually, the AS can support with hundreds of thousands users. Suitable for a university but not for the Internet, where PKIs with digital certificates are better. ■ Off-line Password Attacks: Kerberos is vulnerable to this kind of attacks since a message is encrypted with a key derived from the client's password.

23. 3. Summary ■ Introduced off-line dictionary attack. ■ Briefly discussed the relation btw entity authentication and key exchange. ■ Reviewed a practice-oriented authentication protocol: Kerberos. - Basic ideas - Technical mechanisms - Limitations

24. Questions and Comments?