I'm studying the Kerberos protocol at a high level of abstraction. As I understand it- when a client wants to request a service, it first receives two messages from the TGS.
- A: encrypted with the TGS/service long-term shared key. Will be re-sent unchanged to the service.
- B: encrypted with the TGS/client session key. Contains the client/service session key.
The client is meant to be able to read B, but not A. However, both messages contain the client/service session key. Therefore, the client knows substantially everything contained in message A.
What prevents the client from reversing message A to recover the TGS/service long-term shared key?