What is Kerberos?

Kerberos is an authentication service developed by the Project Athena team at MIT, based on a 1978 paper by Needham and Schroeder [NS78]. The first general use version was version 4. Version 5, which addressed certain shortfalls in version 4, was released in 1994. Kerberos uses secret-key ciphers (see Question 1) for encryption and authentication. Version 4 could only use DES (see Question 64). Unlike a public-key authentication system, it does not produce digital signatures (see Question 3); Kerberos was designed to authenticate requests for network resources rather than to authenticate authorship of documents. Thus, Kerberos does not provide for future third-party verification of documents.

In a Kerberos system, there is a designated site on each network, called the Kerberos server, which performs centralized key management and administrative functions. The server maintains a database containing the secret keys of all users, authenticates the identities of users, and distributes session keys to users and servers who wish to authenticate one another. Kerberos requires trust in a third party, in this case the Kerberos server. If the server were compromised, the integrity of the whole system would be lost. Public-key cryptography was designed precisely to avoid the necessity to trust third parties with secrets (see Question 3). Kerberos is generally considered adequate within an administrative domain; across domains, the more robust functions and properties of public-key systems are often preferred. There has been some developmental work in incorporating public-key cryptography into Kerberos.

| Question 145 |