If the thief installs Kerberos software on his or her own system in order to use the password, we have a record of exactly when and where the password was used. Some valid Kerberos credentials of other users could get stolen, but those are strictly time-limited in value and do not contain information which can be used to guess another password. The session key is used in place of the permanent key to authenticate the two principals to each other, possibly multiple times during the ticket lifetime. If encryption or integrity protection of bulk data is required, yet another key is negotiated by the two principals, called a subkey or a sub-session key . Ticket Kerberos uses encrypted records called tickets to authenticate to Kerberized services 4 .
Tickets generally contain the session key, the user and service ids and the host's IP address.
A ticket is accompanied by an extra copy of the session key encrypted under the user's key. The ability of both user and service to correctly decrypt the relevant parts of the ticket establishes knowledge of the correct keys and therefore establishes authentication for the service. Credential The combination of the ticket and the session key is called a credential . Kerberos The Computing Division at Fermilab has taken the MIT Kerberos V5 product and modified it to provide additional features. It is available in the central product repository, KITS 5 .