2

Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can this be possible with Kerberos?

My understanding was Kerberos is a network authentication protocol of which one of the functions was to allow servers to authenticate each other. The tokens are encrypted but the network traffic between servers won't be unless something like a SSL connection is implemented.

4

Kerberos is used as an authentication protocol, but it's fundamentally a key agreement/exchange protocol.

When a user gets a ticket from Active Directory for an application server a session key is generated and stuffed into the request. The application server decrypts the ticket and now has a session key. The server may decide it doesn't trust that key and in a final act tells the client to use a new provided key.

Once the client and server agree on a key they can communicate privately.

There are multiple catches to this though. The Kerberos spec sort of dictates how you send data back and forth, but it's mostly left to the developer to figure it out. Windows has an implementation, but you don't get to control the parameters like you do with TLS. This means developers tend to just take the key, derive it into something else, and shove it into a seperate protocol.

That said, you probably don't want to use Kerberos for secure communications. You have to build a lot of boilerplating into your code to get it working safely, whereas TLS already handles most of this for you.

  • Just for my clarity, is it the Active Directory that generates the session key? – deltzy Jan 4 at 15:45
  • 1
    It can be, but usually the application server generates it's own and forces the client to use it. – Steve Jan 4 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.