CS470, A.SelcukKerberos1 CS 470 Introduction to Applied Cryptography Instructor: Ali Aydin Selcuk

CS470, A.SelcukKerberos2 Cryptographic authentication for distributed systems Based on symmetric-key authentication with KDC Requirements: –Security –Reliability –Transparency –Scalability

CS470, A.SelcukKerberos3 Advantages: –secure authentication –single sign-on –secure data flow Applications benefiting from Kerberos: –telnet, ftp –BSD rtools (rlogin, rsh, rcp) –NFS –Others (pine, eudora, etc.)

CS470, A.SelcukKerberos4 Kerberos Keys Each “principal” shares a “master key” with KDC K A : Alice’s master key. Used for initial authentication S A : Alice’s session key. Created after initial authentication, used instead of K A. K AB : Alice-Bob session key. “Ticket Granting Tickets” (TGT): –issued to Alice by KDC after login –contains S A encrypted with K KDC –used to obtain session key K AB

CS470, A.SelcukKerberos5 Logging into the Network (doesn’t protect against dictionary attacks with eavesdropping) Alice KDC Alice, pwd K A {S A, TGT} Alice’s terminal Alice needs a TGT

CS470, A.SelcukKerberos6 Logging into the Network (cont’d) The workstation, converts Alice’s password into a DES key when receives the credentials from the server, decrypts them using this DES key if decrypts correctly, authentication is successful discards Alice’s master key; retains the TGT. TGT contains all the information KDC needs about Alice’s session; hence KDC can work without remembering any volatile data.

CS470, A.SelcukKerberos7 Accessing a Remote Principal Afterwards, the traffic between Alice & Bob can be –unprotected –authenticated –encrypted & authenticated Alice KDC rlogin Bob S A {“Bob”, K AB, K B {“Alice”, K AB }} Alice’s workstation “Alice”, “Bob”, TGT, S A {timestamp} Bob K B {“Alice”, K AB }, K AB {timestamp} K AB {timestamp+1}

CS470, A.SelcukKerberos8 Replicated KDCs A single KDC would be –a performance bottleneck –a single point of failure Have multiple replicas of the KDC with the database and the master key Any replica can serve as KDC for authentication Only one KDC (the master copy) handles the additions & deletions of principals (for consistency)

CS470, A.SelcukKerberos9 Multiple Realms KDC A & KDC B must have registered with each other Chains longer than two KDCs not allowed (v.4) KDC B ticket to KDC B Alice “Alice”, “KDC B ” Bob KDC A ticket to Bob “Alice”, “Bob” AP_REQ

CS470, A.SelcukKerberos10 Kerberos v5 Platform-independent coding (ASN.1) Support for non-IP addresses “ “ non-DES encryption Delegation of rights Hierarchy of realms Extended ticket lifetime Has public-key extensions (e.g., SESAME, Win2000)