The KDC decrypts the TGT with its master key, and extracts A's logon session key. A's logon session key is used to decrypt A's authenticator. The second copy is encrypted using the target server's master key, in a ticket along with A's authorization data. A decrypts the target server session key, using her logon session key, and stores the session key in her cache, along with the target server ticket. The ticket for sessions with B, encrypted with B's master key A flag indicating whether the client requests mutual authentication.
B decrypts the ticket, and extracts A's authorization data and session key.
B uses the session key to decrypt A's authenticator, and evaluates the time stamp. If the authenticator passes the test, B looks for a mutual authentication flag. A decrypts the reply with the session key. If the authenticator is identical to the one that she sent B, the client is assured that the server is genuine, and the connection proceeds. All rights reserved.