CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.2  Authentication

1.2  Authentication 1 2 1.2.2  Challenge Handshake Authentication Protocol (CHAP)

Kerberos⁵¹ (defined in RFC 1510⁵²) is an authentication mechanism often used on larger networks, particularly those on which contain UNIX machines. The idea behind Kerberos is to provide authentication and authorization services in an environment where authentication requests originate from machines that are not trustworthy, and travel across a network that is not trustworthy. Kerberos was designed to provide authentication that is secure over a network whose traffic might be intercepted at any time, reliable, transparent to the user (for example, it shouldn’t get in someone’s way by repeatedly requesting a user’s password) and scalable for use in environments with many hosts. An interesting explanation in the form of a narrative play can be found in this footnote⁵³.

It was developed in the mid-1980s by MIT as part of its Project Athena, and a free implementation of the latest version of the protocol is available from MIT, pleasing those who don’t want to trust any cryptosystem without inspecting the program’s source code. Later versions of Windows NT (Windows 2000 and beyond) use an authentication mechanism based on Kerberos, so you’re probably using it, even if you’re not aware of it⁵⁴. For more of the nitty-gritty technical details of the Microsoft Windows 2000 Kerberos implementation, see Secure Networking with Windows 2000 and Trust Services⁵⁵ by Feghhi and Feghhi. To learn more about interoperability between the MIT Kerberos implementation and Windows 2000, check out a list of tips compiled from the experiences of various US universities, as noted in the footnote⁵⁶.

Similar to Windows, the architecture of Kerberos allows for multiple administrative domains, so that different organizations and organizational units can control their own user accounts. In the Kerberos world, these administrative domains are called “realms.” As in the Windows world, it is possible for users to authenticate in one realm and then use services in another, if that remote realm trusts the original realm in which the user authenticated.

1.2  Authentication 1 2 1.2.2  Challenge Handshake Authentication Protocol (CHAP)