Kerberos Authentication

Question

I am trying to understand Kerberos Authentication.

So far my understanding is:

Supposing 'Alice' (A) wants to talk to 'Bob' (B).

Step 1:
A -> S: {A, B, None} K(A, S) Where S is the Kerberos Server, and K(A,S) is a key to communicate between A and S.

Step 2:
S->A {K(A,B), {K(A,B), A} K(B,S)} K(A,S) Server returns the key used to communicate between A and B and a second copy of such key encrypted with a key used to share information between B and S K(B,S). K(B,S) is not known to A. All of this is encrypted with K(A,S).

Step 3:
{K(A,B), A} K(B,S) A sends B the key they will used encrypted with K(B,S)

Step 4:
B->A {Nonce} K(A,B) B decrypts the message and sends back a Nonce encrypted using K(A,B)

Step 5:
A->B {Nonce+1} K(A,B) Sanity test that they are on the same key

Therefore:

If S doesn't authorize the communication between A and B, it wouldn't have certified the key K(A,B) to B. By encrypting {K(A,B) A} K(B,S) we guarantee that S has validated the process. A doesn't have K(B,S), so couldn't validate it itself.

If 'A' used a different key, say K(B,S)' which they attempted passing off, they would be sending: {K(A,B) A} K(B,S)'. When B deciphered this using K(B,S), as the message would have been encrypted using a different key, it wouldn't result in K(A,B), rather some K(A,B)'. So, when B sent back {Nonce} K(A,B)' A wouldn't be able to retrieve the Nonce and complete the authentication.

Have I understood it correctly?

Also (I think this may be a separate question): How does Kerberos independently setup K(A,S) and K(B,S) securely? And how does Kerberos ensure that 'A' is who they say they are?

Answer 1

How does Kerberos independently setup K(A,S) and K(B,S) securely?

For users, the keys are derived from the account password (using the principal & realm names as salt). When you set or change the password on your account, the KDC stores keys derived from it. When you log in using kinit, the Kerberos client derives the same key as the KDC has.

For services, the keys are randomly generated on the KDC, and provided to the service in a "keytab" file out-of-band. Usually the key generation is done via Kadmin RPC secured using an admin's user credentials (and optionally delivered via HTTPS, SFTP, USB stick, etc.)

And how does Kerberos ensure that 'A' is who they say they are?

Just like many other systems, it assumes that only the account owner knows the secret key – therefore whoever knows the secret key must be the account owner.

---

Note also that since the service itself has K(B,S) it can craft "fake" tickets for A→B; sometimes that's considered a feature.