Talk:Kerberos (protocol)

message: I think the relase date and version should be removed, because it's not the version and release of the protocol, but one (and only one) of the implementations.  — Preceding unsigned comment added by Qji (talk • contribs) 09:41, 27 January 2016 (UTC)
thread_title:  Release date and version? 

message: According to The Moron's Guide to Kerberos, in Kerberos 5 the final step of authenticating the service to the client does not increment the timestamp. It says:
It used to be the case (in version 4 of Kerberos) that the service would instead add 1 to the timestamp value, and return it, encrypted in the session key. That has been changed in version 5 of Kerberos.
I do not know Kerberos well enough to know whether Wikipedia is right or the Guide (I presume this page wants to be right for Kerberos 5, but I do not think that is stated anywhere).
:The guide is right.  Kerberos 5 simply sends back a message copying the time from the client to the server.  The message is of a different form and an attacker cannot break transform one message into another.  See RFC 4120 section 5.5.2.
:--SamHartman 16:56, 16 September 2007 (UTC)
thread_title:  Kerberos 4 vs. Kerberos 5 

message: The article claims that NFSv4 supports kerberos (true), but Solaris has supported kerberized NFS even with the earlier versions of the protocol.
----
Frodo Looijaard (20051103)
Note too that as of Mac OS X 10.5, Apple are providing Kerberized NFSv3 support, both in OS X Server as a server, and in OS X client as a client.
-----
Anonymous Coward.  —Preceding unsigned comment added by 24.6.229.110 (talk) 02:27, 9 December 2007 (UTC)
thread_title:  Kerberized NFS 

message: Currently, the article looks inconsistent because the protocol messages (in "The protocol") don't match up with the operation (given in "Kerberos operation"). Things diverge in step 4 of the operation, where two messages are sent back. Only one message is sent in the protocol. Perhaps someone could fix this? 82.36.100.133 12 Aug 2006
:The BAN Logic seems quite broken.  As best I can tell it is close to Kerberos 4 but it is even wrong for that.  I recommend we remove the protocol section's BAN Logic and then update the remaining text to be consistent with  Kerberos 5.  I recommend we explicitly mention we're describing Kerberos 5.
:--SamHartman 16:56, 16 September 2007 (UTC)
thread_title:  "Protocol" and "operation" mismatch 

message: I think that the article should be moved to Kerberos (protocol) because it would be more consistent with Wikipedia naming conventions.  Note that the topic is identified as only "Kerberos" both generally and in the title restatement.  Thoughts?  ENeville 17:02, 20 October 2006 (UTC)
replies: text: Agreed. -- intgr 22:55, 17 January 2007 (UTC)
thread_title:  Move to Kerberos (protocol)? 

message: There is a version of Kerberos called Bones, which is exactly like Kerberos, except that Bones doesn't encrypt any of the messages. So what is it good for? The U.S. restricts export of cryptography; if it's sufficiently advanced, it qualifies as munitions, in fact. At one time, it was extraordinarily difficult to get crypto software out of the U.S. On the other hand, there is a wide variety of legitimate software that is exported (or created outside the U.S. altogether), and expects Kerberos to be there. Such software can be shipped with Bones instead of Kerberos, tricking them into thinking that Kerberos is there. 
Doug Rickard wrote to explain how Bones got its name. In 1988, he was working at MIT, with the Project Athena group. He was trying to get permission from the State Department to export Kerberos to Bond University in Australia. The State Department wouldn't allow it--not with DES included. To get it out of the country, they had to not only remove all calls to DES routines, but all comments and textual references to them as well, so that (superficially, at least) it was non-trivial to determine where the calls were originally placed. 
To strip out all the DES calls and garbage, John Kohl wrote a program called piranha. At one of their progress meetings, Doug jokingly said, "And we are left with nothing but the Bones." For lack of a better term, he then used the word "Bones" and "boned" in the meeting minutes to distinguish between the DES and non-DES versions of Kerberos. "It somehow stuck," he says, "and I have been ashamed of it ever since." 
Back at Bond University, Errol Young then put encryption back into Bones, thus creating Encrypted Bones, or E-Bones. 
Its from Moron's guide to Kerberos —The preceding unsigned comment was added by Wk muriithi (talk • contribs) 06:45, 13 January 2007 (UTC)
thread_title:  Found this paragraphs really funny 

message: I'm new to Kerberos, but the described protocol seems vulnerable to a reply-attack: if an intruder I records message 3 and resend it soon, B detects it as host A. The problem is that A don't authenticates to B. This should be done with something as:
4: B \rightarrow A: \{T_A + 1\}_{K_{AB}}, N_B
5: A \rightarrow B: \{N_B + 1\}_{K_{AB}} —The preceding unsigned comment was added by 213.140.6.116 (talk) 00:28, 8 April 2007 (UTC)
thread_title:  Reply attack to described protocol? 

message: Should not Microsoft Office SharePoint Server 2007 be added to the list of software that supports Kerberos authentication?  —Preceding unsigned comment added by 81.144.188.98 (talk) 15:21, 15 November 2007 (UTC)
thread_title:  Missing Software? 

message: I don't know the IPA but could someone add something about how to pronounce this? It's something like Kerb-er-ross 202.160.118.227 05:02, 2 December 2007 (UTC)
thread_title:  Kerberos Pronunciation 

message: This phrase: A compromised client will compromise the user's password - seems absurd, since the compromised client of any system can compromise a user's password. This is not a drawback of Kerberos. Brutforzz (talk)  —Preceding undated comment was added on 09:23, 24 February 2009 (UTC)
thread_title:  Drawbacks 

message: I think it's a good idea to have this article written using the Security protocol notation like other protocols have. For example Wide Mouth Frog protocol. I'll do it when I finish my exams and I get some free time but feel free to do it before if you want.
--PabloCastellano (talk) 20:05, 27 June 2009 (UTC)
thread_title:  Notation 

message: There is a image with all Russian (or some other Cryillic language) captions on it. This isn't useful on english language wikipedia.  — Preceding unsigned comment added by 207.126.248.6 (talk) 21:42, 16 February 2012 (UTC)
replies: text: Agreed, I've removed it. Without knowing the terms the diagram is not helpful.--Flexdream (talk) 16:28, 4 March 2012 (UTC)
thread_title:  Russian Image Not Helpful 

message: :Kerberos cannot be used in scenarios where users want to connect to services from unknown/untrusted clients [..]
As far as I have used Kerberos to access some AFS shares at my university I didn't have to "register" my home machine anywhere. I only had to edit my configuration to point proper servers. —Stlman (talk) 11:09, 26 October 2014 (UTC)
thread_title:  Drawbacks and Limitations: Trust requirement 

message: Hello fellow Wikipedians,
I have just modified 2 external links on Kerberos (protocol). Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20021203013358/http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html to http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html
*Added archive https://web.archive.org/web/20040707075602/http://www.ietf.org/html.charters/krb-wg-charter.html to http://www.ietf.org/html.charters/krb-wg-charter.html
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 02:10, 9 December 2017 (UTC)
thread_title:  External links modified