Kerberos

Kerberos, created by MIT in the 1980s as Project Athena, is a single sign-on authentication protocol that provides secure and trusted communication over an insecure network.

It is designed to authenticate users and systems by using secret-key cryptography, ensuring that only authorized entities can access resources and services. The fundamental procedures for authentication in a Kerberos environment involves a client, a server, and a Key Distribution Center (KDC). The KDC, trusted by both customers and services, manages authentication. Its role can be separated into two services:

• AS (Authentication Service): Issues ticket-granting ticket (TGT) for accessing the TGS.
• TGS (Ticket Granting Service): Provides access tickets for different services.

The protocol involves the following steps:

• A secret key is generated from the authentication password (login on the machine), which is used to decrypt messages received.
• When the users ask the permission to access some service, the authentication service Key Distribution Center (KDC) verifies the credential and generates (if credentials are validates) a TGT.
• The TGT is sends back to the user with a session key (both are encrypted). The users sends the current TGT to the TGS with the Service Principal Name (SPN) of the resource the client wants to access
• If the user has access rights, the TGS generates a service ticket and sends it to the user. The user then sends their own authentication message along with the service ticket to the service to initiate the connection. Both the user and the server authenticate each other, and once completed, the user gains access to the resource.

Kerberos continues to be widely employed, delivering various merits including its maturity, robustness, established presence, and alignment with the demands of modern distributed systems.