It then uses the new session key contained in the ticket to decipher the authenticator and does the same validation process that was described in step 4. Once the server has validated a client, an option exists for the client to validate the server. This prevents an intruder from impersonating the server. This message is enciphered using the session key that was passed from the client to the server. Every ticket is associated with a session key that is assigned every time a ticket is allocated.
Tickets are reusable.
Every ticket has a lifetime, typically eight hours. After a ticket has expired, you have to identify yourself to Kerberos again, entering your login name and password. Unlike a ticket, which can be reused, a new authenticator is required every time the client initiates a new connection with a server. A server should maintain a history of previous client requests for which the timestamp in the authenticator is still valid. This way a server can reject duplicate requests that could arise from a stolen ticket and authenticator.