Kerberos

Goals

Authenticate peers in a distributed environment.

Targeted for Athena (at MIT)

Distribute session keys for adding security to sessions between peers.

Authentication (the initial goal)
Confidentiality (optional)

Single Sign-On.

Only one password to remember
Daily use (typically)

Background: Needham-Schroeder (1978)

A and B trust on a common Key Distribution Center (KDC).

KDC shares a key with every A and B. Central authentication authority.

KDC generates good (random) $K_{ab}$ keys.

Directly imported by requesters
Indirectly obtained by targets

Architecture and base concepts

Two Kerberos KDC services

Authentication Service (AS)
Ticket Granting Server (TGS)

Entities (principals)

All have a secret shared with Kerberos (AS or TGS)
People: a key derived from a password:
- $K_U$ = hash(password)
- Services/servers: key stored in some repository.
Requisites
- Clocks (very well) synchronized.

Authentication elements

Ticket: required to request a service.
Authenticator: proof of the identity of a requester.

Tickets and authenticators

Ticket

Unforgeable piece of data.

It can only be interpreted by the target service.

Carries the identities of the client that can use it.

Carries a session key.

Carries a validity timestamp.

Authenticator

Carries a timestamp of the request.

Carries the identity of the client.

Proves that the client knows the session key.

Overview of Kerberos SSO

Location of the Kerberos servers of the realm.

Authentication of user U by Kerberos (AS).

The user gets a Ticket Granting Ticket (TGT) and a session key ( $K_{TGT}$ ) for interacting with another Kerberos service (TGS).
The TGT can be used to request other tickets needed by the user U to access every service S.

2nd step: Authenticated access to servers

U requests Kerberos (TGS) a ticket for accessing S.

U uses TGT in the request.
U must prove that he is the owner of TGT.
U gets a session key $(K_{US})$ and a ticket to S $(T_{US})$ .

U uses $(T_{US})$ to make authenticated requests to S.

Server S uses $T_{US}$ to check the identity of U.
U must prove that he is the owner of $T_{US}$ .

Protocol (of version V5)

Pre-authentication alternative

Vulnerable to proactive dictionary attacks! (Kerberoasting).

Scalability

Authentication scope

Realms.

A kerberos server per realm.

Inter-realm cooperation

Fundamental to allow a client from a realm to access a server in another realm.

Realms need to trust authentication performed by other realms.

Protocol

Secret keys are shared between TGS servers of different realms.

Inter-realm key.
Each inter-realm key is associated with a trust path.

A client (user) needs to jump from TGS to TGS to get a ticket.

Not particularly user-friendly.

Security politics and mechanisms

Entity authentication

Secret keys, names, and network addresses.

name/instance@realm (user@ua.pt, ftp/ftp.ua.pt@ua.pt).

Validity periods

Timestamps in tickets (hours).

Timestamps in authenticators (seconds, minutes).

Replay protections

Nonces (in ticket distributions).

Timestamps / sequence numbers (in authenticators).

Protection against an excessive use of session keys

Key distribution in authenticators.

Delegation (proxying)

Options and authorizations in tickets.

Inter-real authentication

Secret keys shared among TGS services, trust paths.

Ticket issuing from a TGS to another TGS.

Security issues

Kerberos KDC can impersonate anyone. Needs maximum security in its administration.

Kerberos KDC may be a single point of failure. Replication is an option since stored keys are seldom updated.

A stolen user password allows others to impersonate the victim in every service of the realm. Stolen TGS credentials are less risky, as their validity is shortly limited (one day, usually).