whatis.texi revision 55682 
1@node What is Kerberos?, Building and Installing, Introduction, Top
2@chapter What is Kerberos?
3
4@quotation
5@flushleft
6        Now this Cerberus had three heads of dogs,
7        the tail of a dragon, and on his back the
8        heads of all sorts of snakes.
9        --- Pseudo-Apollodorus Library 2.5.12
10@end flushleft
11@end quotation
12
13Kerberos is a system for authenticating users and services on a network.
14It is built upon the assumption that the network is ``unsafe''.  For
15example, data sent over the network can be eavesdropped and altered, and
16addresses can also be faked.  Therefore they cannot be used for
17authentication purposes.
18@cindex authentication
19
20Kerberos is a trusted third-party service.  That means that there is a
21third party (the kerberos server) that is trusted by all the entities on
22the network (users and services, usually called @dfn{principals}).  All
23principals share a secret password (or key) with the kerberos server and
24this enables principals to verify that the messages from the kerberos
25server are authentic.  Thus trusting the kerberos server, users and
26services can authenticate each other.
27
28@section Basic mechanism
29
30@ifinfo
31@macro sub{arg}
32<\arg\>
33@end macro
34@end ifinfo
35
36@tex
37@def@xsub#1{$_{#1}$}
38@global@let@sub=@xsub
39@end tex
40
41@ifhtml
42@macro sub{arg}
43<\arg\>
44@end macro
45@end ifhtml
46
47@quotation
48@strong{Note:} This discussion is about Kerberos version 4, but version
495 works similarly.
50@end quotation
51
52In Kerberos, principals use @dfn{tickets} to prove that they are who
53they claim to be. In the following example, @var{A} is the initiator of
54the authentication exchange, usually a user, and @var{B} is the service
55that @var{A} wishes to use.
56
57To obtain a ticket for a specific service, @var{A} sends a ticket
58request to the kerberos server. The request contains @var{A}'s and
59@var{B}'s names (along with some other fields). The kerberos server
60checks that both @var{A} and @var{B} are valid principals.
61
62Having verified the validity of the principals, it creates a packet
63containing @var{A}'s and @var{B}'s names, @var{A}'s network address
64(@var{A@sub{addr}}), the current time (@var{t@sub{issue}}), the lifetime
65of the ticket (@var{life}), and a secret @dfn{session key}
66@cindex session key
67(@var{K@sub{AB}}). This packet is encrypted with @var{B}'s secret key
68(@var{K@sub{B}}).  The actual ticket (@var{T@sub{AB}}) looks like this:
69(@{@var{A}, @var{B}, @var{A@sub{addr}}, @var{t@sub{issue}}, @var{life},
70@var{K@sub{AB}}@}@var{K@sub{B}}).
71
72The reply to @var{A} consists of the ticket (@var{T@sub{AB}}), @var{B}'s
73name, the current time, the lifetime of the ticket, and the session key, all
74encrypted in @var{A}'s secret key (@{@var{B}, @var{t@sub{issue}},
75@var{life}, @var{K@sub{AB}}, @var{T@sub{AB}}@}@var{K@sub{A}}). @var{A}
76decrypts the reply and retains it for later use.
77
78@sp 1
79
80Before sending a message to @var{B}, @var{A} creates an authenticator
81consisting of @var{A}'s name, @var{A}'s address, the current time, and a
82``checksum'' chosen by @var{A}, all encrypted with the secret session
83key (@{@var{A}, @var{A@sub{addr}}, @var{t@sub{current}},
84@var{checksum}@}@var{K@sub{AB}}). This is sent together with the ticket
85received from the kerberos server to @var{B}.  Upon reception, @var{B}
86decrypts the ticket using @var{B}'s secret key.  Since the ticket
87contains the session key that the authenticator was encrypted with,
88@var{B} can now also decrypt the authenticator. To verify that @var{A}
89really is @var{A}, @var{B} now has to compare the contents of the ticket
90with that of the authenticator. If everything matches, @var{B} now
91considers @var{A} as properly authenticated.
92
93@c (here we should have some more explanations)
94
95@section Different attacks
96
97@subheading Impersonating A
98
99An impostor, @var{C} could steal the authenticator and the ticket as it
100is transmitted across the network, and use them to impersonate
101@var{A}. The address in the ticket and the authenticator was added to
102make it more difficult to perform this attack.  To succeed @var{C} will
103have to either use the same machine as @var{A} or fake the source
104addresses of the packets. By including the time stamp in the
105authenticator, @var{C} does not have much time in which to mount the
106attack.
107
108@subheading Impersonating B
109
110@var{C} can hijack @var{B}'s network address, and when @var{A} sends
111her credentials, @var{C} just pretend to verify them. @var{C} can't
112be sure that she is talking to @var{A}.
113
114@section Defense strategies
115
116It would be possible to add a @dfn{replay cache}
117@cindex replay cache
118to the server side.  The idea is to save the authenticators sent during
119the last few minutes, so that @var{B} can detect when someone is trying
120to retransmit an already used message. This is somewhat impractical
121(mostly regarding efficiency), and is not part of Kerberos 4; MIT
122Kerberos 5 contains it.
123
124To authenticate @var{B}, @var{A} might request that @var{B} sends
125something back that proves that @var{B} has access to the session
126key. An example of this is the checksum that @var{A} sent as part of the
127authenticator. One typical procedure is to add one to the checksum,
128encrypt it with the session key and send it back to @var{A}.  This is
129called @dfn{mutual authentication}.
130
131The session key can also be used to add cryptographic checksums to the
132messages sent between @var{A} and @var{B} (known as @dfn{message
133integrity}).  Encryption can also be added (@dfn{message
134confidentiality}). This is probably the best approach in all cases.
135@cindex integrity
136@cindex confidentiality
137
138@section Further reading
139
140The original paper on Kerberos from 1988 is @cite{Kerberos: An
141Authentication Service for Open Network Systems}, by Jennifer Steiner,
142Clifford Neuman and Jeffrey I. Schiller.
143
144A less technical description can be found in @cite{Designing an
145Authentication System: a Dialogue in Four Scenes} by Bill Bryant, also
146from 1988.
147
148These documents can be found on our web-page at
149@url{http://www.pdc.kth.se/kth-krb/}.
150