I'm trying to understand how Kerberos works, in particular how the initial client sends a request to the Access Server. Some YouTube videos I've seen say the initial request is partially encrypted using the client's password. First, what is meant by "partially" encrypted? Second, considering a password is just an arbitrary string I didn't think it could be used as a symmetric key. Can any string be a symmetric key? I thought it's a special process to derive keys.
In another video I heard the message is not encrypted but a nonce is used to prevent a replay attack. If this is the case, how exactly does a nonce prevent a replay attack? The initial request must contain the password/hash, otherwise where's the actual security from any machine requesting a ticket?