and figures out what someone's password is. So this is something also you want to avoid in any protocol you design now. Kerberos version NUMBER_TOKEN actually supports multiple different encryption schemes including AES and other things as well. So that seems like a much better way to do it. On the other hand, MIT actually kept supporting DES up until two years ago, which is a little unfortunate. But now they don't. So that's good. Your principal is secure at least from this kind of attack. All right, so does that make sense? This is the initial way you'd get any ticket at all in Kerberos. And typically, you'd get this ticket from this TGS service. So now let's look at what's going on in this TGS service. So here, the interaction with the TGS service is going to be a little different. On one hand, you're going to-- as a client, you're going to have to speak to it as if you're speaking to any other Kerberos enabled service. So we'll see how you authenticate yourself with a ticket to some machine. But then the response you're going to get back is just a ticket for some other principle that you're going to want to communicate with like your file server. So the protocol level messages that show up here kind of look like this. So here's your TGS service. And here's a client. The client already got a ticket for TGS using this protocol above. So what the client is actually going to send over is some combination of messages that prove that this is the right client and they're issuing a request for some particular principle through TGS. So what the client is going to send to TGS is this tuple. So first, it's going to say, well, here's the service that I want to talk to next. So this might be your mail server or your file server. Then is going to include the ticket. It already got NUMBER_TOKENTGS. So this is going to be TC of TGS encrypted with KTGS. So this is just this thing where S is TGS. And then you're going to have to include this authenticator blob. This is this AC thing from up there. And this thing is going to be encrypted with a shared key between the client and the TGS service. So this is the message that you're going to send to TGS. It's going to look at this message, do something with it that we'll talk about in a second, and respond back with a ticket for this new service S. So the response here looks almost exactly like here. In fact, it is exactly the same thing. It's going to be a ticket between the client and this new service S encrypted with KS and the shared key between the client and this new service S encrypted-- well, now, here's a little bit different. Instead of encrypting with KC, which the client has probably forgotten since then, now we're going to encrypt it with this shared key between the client and the TGS service. Makes sense? All right, so in this-- how does the server actually figure out what the client wants to do? Or, how does server authenticate the client? Well, in this case, it's going to-- TGS server actually knows its own key, KTGS. So it's
NO_SEGMENT_TOKEN