Do public keys make Kerberos more secure (RFC4556)?

Question

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556.

From my understanding of how Kerberos works, it doesn't actually send the password. So I'm wondering: How does public keys add to the security of Kerberos? Is it something I should be using?

As a side note: We have some Mac users in our office, and unfortunately pkinit is missing. I haven't been able to find much about why this is, other than this post on the Apple mailing list saying "we highly recommend against using this for any purpose". Is this because of the security of RFC4556, or the security of how the platform used that protocol?

Answer 1

From RFC4556 :

In the AS exchange, the KDC reply contains the ticket session key, among other items, that is encrypted using a key (the AS reply key) shared between the client and the KDC. The AS reply key is typically derived from the client's password for human users. Therefore, for human users, the attack resistance strength of the Kerberos protocol is no stronger than the strength of their passwords.

Therefore PKI extension is supposed to improve security of this initial Authentication Service exchange.