I'm studying the Kerberos protocol at a high level of abstraction. As I understand it- when a client wants to request a service, it first receives two messages from the TGS.

  • A: encrypted with the TGS/service long-term shared key. Will be re-sent unchanged to the service.
  • B: encrypted with the TGS/client session key. Contains the client/service session key.

The client is meant to be able to read B, but not A. However, both messages contain the client/service session key. Therefore, the client knows substantially everything contained in message A.

What prevents the client from reversing message A to recover the TGS/service long-term shared key?

  • Is your question whether the client can decrypt the A ticket data intended for the service because it contains known plaintext?
    – PwdRsch
    Commented Mar 30, 2017 at 23:09
  • @PwdRsch yes. Does Kerberos use a crypto algorithm which is robust to known-plaintext attacks? Commented Mar 30, 2017 at 23:23
  • 1
    Modern implementations of Kerberos 5 should use AES for encryption, which shouldn't be particularly susceptible to that type of attack. crypto.stackexchange.com/questions/1512/…
    – PwdRsch
    Commented Mar 31, 2017 at 0:16

1 Answer 1


Tl;Dr - nothing, you can crack it. It is called keberoasting. The TGS shared secret can be cracked, but there are some issues trying to do that. Since the common case is that that the shared secret is the machine account password, getting that password allows you access to that specific machine (via silver tickets) or in the case of a DC to every domain password (via DCsync) (service accounts are the uncommon case and are a prime target of kerberoasting) The password is changed automatically every 30 days, it's encrypted with aes(normally) and is a binary (256 options) randomly generated password of up to 32 chars hashed with md4, with a specific salt when traveling as part of a kerberos tgs request. Meaning that a true brute force is needed and the end result isn't as rewarding as the other quicker and easier options.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .