I've reviewed the RFCs and am pretty familiar with Kerberos.

It seems to me that over a non-encrypted link (HTTP), Kerberos doesn't leak the user's password (or hash based challenge/response like NTLMv1/v2) and/or is susceptible to a reply attack.

In a properly designed implementation of Kerberos, is HTTP authentication considered secure over a non-encrypted link?

1 Answer 1


Kerberos authentication on HTTP will encapsulate Kerberos ticket inside a SPNEGO token and will not expose user credentials. Replay attack is stopped by authenticators. But there is a possibility to do a active MITM attack where you would prevent server from receiving captured authenticator. Please see this paper for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.