If you look at the above Kerberos protocol's diagram, you can find that the protocol works on the basis that the (symmetric) client key initially exists on both the client node and the key distribution center.

Then, the question is, how can we share the initial (symmetric) client key safely through untrusted network (as Kerberos intends to work on)?

  • 2
    Take a look at Diffie-Hellman key exchange for an example of one commonly used method for enabling two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel.
    – mti2935
    Apr 25, 2022 at 1:00

1 Answer 1


For users, the key is normally derived from their password. It's delivered out of band in the same way that a sysadmin usually delivers users their initial passwords (paper, phone, insecure email, etc).

For services, the key can also be delivered out of band (e.g. by SFTPing a keytab file over SSH or downloading it over HTTPS), or by using an admin's Kerberos credentials to authenticate to the KDC admin service – e.g. Active Directory joins are done by creating the machine account over a Kerberos-authenticated (and encrypted) LDAP session.

Kerberos also has the 'PKINIT' extension which changes the initial AS step to use X.509 certificate authentication instead (together with DH key exchange); this shifts the initial trust problem elsewhere.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .