CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.2  Authentication

1.2  Authentication 1 2 1.2.2  Challenge Handshake Authentication Protocol (CHAP)

How Does Kerberos Authentication Work?

A complete explanation of the Kerberos protocol is beyond the scope of this book, but briefly, here’s a (very) simplified explanation as to how Kerberos authentication works.

A user authenticates himself when he logs into the network. He provides his user name, and the user workstation then connects to a special “ticket-granting service” on a specific network host called an Authentication Server (AS), for login verification. The AS issues the user a credential (encrypted with that user’s key, known by the server) called a “ticket.” The client machine holds on to this ticket, and uses it to demonstrate the user’s identity when requesting network services.

If the user supplies a valid password, the session key is used in later attempts to connect to network services – it is sent to the service as proof of the client’s identity, along with a special message called an “authenticator” (with information like the client name, IP address and current time). The service can then decide whether or not the user is authorized to use the service, based on their identity, and allow or disallow the connection attempt.

Optionally, mutual authentication can take place; with the server proving its identity to the client as well as the client proving its identity to the server (see section 1.2.7).

Kerberos assumes the use of a strong password, since it employs conventional encryption mechanisms. The Kerberos authentication mechanism uses an encrypted password.

According to the creator of Kerberos (MIT), various versions of Kerberos are vulnerable to buffer overflows and DoS attacks (section 1.4.1). Additionally, the Kerberos protocol is somewhat subject to “replay” attacks in which legitimate packets are captured and later “replayed” from an impostor’s machine, although this has been mitigated somewhat by the addition of timestamps to packets. Additionally, it is indirectly vulnerable to brute-force password guessing attacks.

1.2  Authentication 1 2 1.2.2  Challenge Handshake Authentication Protocol (CHAP)