0

Well first this is a general protocol Kerberos v4

(1) C -> AS: IDc||IDtgs

(2) AS -> C: Ekc[Kc,tgs||TGT]

(3) C -> TGS: TGT||Authenticator

(4) TGS -> C: Ekc,tgs[Kc,v||Ticketv]

(5) C -> V: Ticketv||Authenticator'c

Notation:

C = Client

AS = authentication server

V = server

IDc = identifier of user on C

IDv = identifier of V

Kc = secret key derived from the user’s password on C

Kv= secret encryption key shared by AS an V

TS = timestamp

|| = concatenation

TGT = Ticket Granting Ticket

TGS = Ticket Granting Server

Authenticator simply includes ID of user on client and also a timestamp.

Question: why message (1) does not contain authenticator? Cheers!

Improve this question
2
  • Kerberos v4 is nearly 30 years old (1987), and you are encouraged to use the newer Kerberos v5 instead. I don't think you'll have much luck asking an explanation for particular krb4 design decisions.
    – Jacob
    Jan 10, 2017 at 18:42
  • @Jacob well god loves a tryer tho, you'll never know. Plus all the beautiful things are built from the 'old' things, they are fundamental. If you can't figure out them, the more you learn about new stuff, the easier you are likely to fail.
    – Shan Huang
    Jul 20, 2018 at 7:10

1 Answer 1

Reset to default
1

Kerberos first message only checks that the login id exists in the KDC and that the time are synchronized with the AS. There is no authenticator because, a replay attack at (1) does not make sense.

Authenticator is created mainly for AS and TGS.

As you can see from your (3) the authenticator appears at this point. This is where the access to server is requested. Ticket from (2) is validated and user authentication is validated.

Improve this answer
1
  • That's fair enough.
    – Shan Huang
    Jul 20, 2018 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.