Kerberos (protocol)
Kerberos (pronounced "kur-ber-uhs") is a computer network authentication protocol, which allows people communicating over a non-secure network to prove their identity to one another in a secure manner. It is also a suite of free software published by Massachusetts Institute of Technology (MIT) that implements this protocol. Its designers aimed primarily at a client-server model, and it provides mutual authentication — both the user and the server verify each other's identity. Kerberos protocol messages are protected against spying and replay attacks.
Kerberos performs authentication as a trusted third party authentication service by using cryptographic shared secret under the assumption that packets traveling along the insecure network can be read, modified, and inserted. Kerberos builds on symmetric-key cryptography and requires a key distribution center. Extensions to Kerberos can provide for the use of public-key cryptography during certain phases of authentication.
MIT developed Kerberos to protect network services provided by Project Athena. The protocol was named after the Greek mythological character "Kerberos" (or "Cerberus"), known in Greek mythology as being the monstrous three-headed guard dog of Hades. Several versions of the protocol exist; versions 1–3 used only internally at MIT.
Steve Miller and Clifford Neuman, the primary designers of Kerberos version 4 (which used the DES encryption algorithm with 56-bit keys),
published that version in 1989, although they had targeted it primarily for Project Athena.
Version 5, designed by John Kohl and Clifford Neuman, appeared as RFC 1510 in 1993 (made obsolete by RFC 4120 in 2005), with the intention of overcoming the limitations and security problems of Version 4. The MIT makes an implementation of Kerberos Version 5 freely available, under a software license similar to that used by BSD license.
Several companies used Kerberos Version 5 in commercial software including:
In 2005, the IETF Kerberos working group introduced a new updated specifications for Kerberos Version 5 . updates include:
In 2007, MIT formed the Kerberos Consortium for continuation of development.
Kerberos uses as its basis the Needham-Schroeder protocol. It makes use of a trusted third party authentication known as "key distribution center (KDC)", which consists of two logically separate parts: an Authentication Server (AS) and a Ticket Granting Server (TGS). Kerberos works on the basis of "tickets" (called Kerberos tickets) which serve to prove the identity of users.
Kerberos database: The key distribution center (KDC) maintains a database of secret keys; each entity on the network — whether a client or a server — shares a secret key known only to itself and to the KDC. Knowledge of this key serves to prove the identity of each entity. For communication between two entities, the KDC generates a session key which they can use to secure their communications.
The term "Kerberos server" generally refers to the KDC. For reliability purposes, it is possible to have backup KDCs. These are referred to as "Kerberos slave servers". All slaves synchronize their databases from the master Kerberos server.
The term "Kerberized application server" generally refers to Kerberized programs that clients communicate with using Kerberos tickets for authentication. For example, the Kerberos telnet server is an example of a Kerberized application server . While the term "Kerberized applications" is used to referrer to the client side of Kerberized application server , For example, the Kerberos telnet client is an example of a Kerberized applications
The security of the protocol depends heavily on:
The following abbreviations will be used:
Briefly, the client authenticates to AS using a long-term "shared secret" and receives a ticket from the AS. Later the client can use this ticket to get additional tickets for SS using the same shared secret. These tickets can be used to prove authentication to SS.
User Client-based Logon Steps:
Client Authentication Steps:
Client Service Authorization Steps:
Client Service Request Steps:
Key distribution center
In cryptography, a key distribution center (KDC) is part of a cryptosystem intended to minimize the risks of exchanging keys and shared secrets.
KDCs often operate in systems when some users may have permission to use certain resources at some times but not at any times.
Alonzo Church
Alonzo Church (June 14, 1903 – August 11, 1995) was an American mathematician and logician who made major contributions to mathematical logic and the foundations of theoretical computer science. He is best known for the lambda calculus, Church's thesis and the Church-Rosser theorem.
Software suite
A software suite or application suite, is a collection of computer programs —usually application software or programming software— of related functionality, often sharing a more-or-less common user interface and some ability to smoothly exchange data with each other. .
Sometimes software "suites" are at a lower price than buying each of "suite" programs.
Ayin
Ayin is the sixteenth letter of the Hebrew alphabet.
Dalet
Dalet (also spelled or Daleth) is the fourth letter of the Hebrew alphabet. In set theory, mathematicians originally intended to use daleth to represent the fourth transfinite cardinal numbers. The name "dalet" is connected to the word "delet", meaning "door". It also corresponds to the letter "delta" in the Greek alphabet.
Bet (letter)
Bet, Beth, or Vet is the second letter of the Hebrew alphabet. It is represented by "ב".
In set theory, the letter formula_1 is used to represent a series of infinite cardinal numbers (called beth numbers).
The Hebrew alphabet is often called "aleph-bet", because of its first two letters.
Gimel
Gimel is the third letter of the Hebrew alphabet.
The Phoenician letter gave rise to the Greek gamma (Γ), the Latin C, G and F, and the Cyrillic Г.
In set theory (particularly in the theory of infinite cardinal numbers), the formula_1 symbol is used to represent the gimel function. The Hebrew gimel corresponds to the letter G in English.
He (letter)
He is the fifth letter of the Hebrew alphabet.
Waw (letter)
Waw (, also spelled vav or vau) () is the sixth letter of the Hebrew alphabet. Its symbol in Ancient Hebrew writing is a arm raised up. Its symbol in Modern Hebrew writing today is a line going from top to bottom. It makes the sounds of many letters.
Pornographic movie actor
A pornographic actor/actress or a porn star is somebody who appears in pornographic movies.
Jenna Jameson, Ron Jeremy, Marilyn Chambers and Linda Lovelace are some famous porn stars.
Friend Like That
Friend Like That is a Pop punk song released by the band Hawk Nelson. Made available on Christmas Eve on iTunes and other websites.
It's a song with simplicity and slightly silly but meaningful lyrics and the second song you will hear from their new album.
The music video for Friend Like That shows the band in a cartoon world. The singer, Jason Dunn is running while other members of the band wait patiently for him to reach them. Then they get into the bus and drive. During the breakdown, some of them are singing in the van. They get off the van and go through a door, to find themselves playing a Live concert on stage.
Nonviolence
Nonviolence is a philosophy that rejects the use of physical violence. People who practice nonviolence when expressing their beliefs may use methods like education, persuasion, civil disobedience, and conscientous objection to military service.
A demonstration by a group of people in a public place, to show their support or to protest, is permitted on the condition that it remain nonviolent. Sometimes the demonstrators are nonviolent but other people who oppose them will come to the demonstration and behave violently to show their opposition.