Additionally, this document specifies support for delegation of Kerberos credentials, which enables end to end authentication within an n-tier architecture. The proposed changes are minimal and, in fact, no different from adding a new public key algorithm to the TLS framework. This section describes the addition of the Kerberos authentication option to the TLS protocol. Throughout this document, we refer to the basic SSL handshake shown in Figure 1. The TLS protocol.
All messages followed by a star are optional.
The TLS security context is negotiated in the client and server hello messages. If the TLS server supports the Kerberos authentication option, the server hello message, sent to the client, will confirm the Kerberos cipher suite selected by the server. The server's certificate and the ServerKeyExchange shown in Figure 1 will be omitted since authentication and the establishment of a master secret will be done using the client's Kerberos credentials for the TLS server. However, only the client Certificate and the ClientKeyExchange are required. If the server accepts a Kerberos-based ciphersuite, then it MUST send the CertificateRequest message to the client.