# What is sent on the initial communication with Kerberos?

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication?

Something which is not clear to me:

Will she send a message containing

• time

generated with the session key of the kerberos client and authentication server?

Or will she send a message to the AS containing

• time

encrypted with Alice's password and this again encrypted with a session key?

-

If you look at RFC 1510, (an overview and specification of Version 5 of the Kerberos network authentication system), the initial exchange involves the client (Bob) sending its own identity, and the identity of the server (Alice) for which it is requesting credentials in cleartext. The response contains a ticket for the client to present to the server, and a session key that will be shared by the client and server. The session key and additional information are encrypted using the client's secret key (which is stored on the Authentication Server).

The request message contains the client's principal name as well as the server's principal name, the time and a nonce to prevent replays. The reply message contains information which can be used to detect replays, and to associate it with the message to which it replies.

In the normal case, the authentication server does not know whether or not the client is actually the principal named in the request. It simply sends a reply without knowing or caring whether or not they are the same. This is acceptable since nobody but the requesting principal (client) will be able to decode the reply.

For further information, have a look at Section 3 - Message Exchange of RFC 1510.

-
No no, I meant I am Alice I want to talk to Bob, we still have the ticket granting service and authentication service. When Authenticating with the kerberos client to the AS, you send a message containing the current timestamp and your username. I knew the password fitted in somewhere but I didn't know where anymore :). –  Lucas Kauffman Aug 18 '11 at 16:29
The simple answer to your question is no, your password is not transmitted at any time since the hash of your password is kept on the Authentication Server. The Authentication Server uses this to encrypt the ticket and the session key that Alice and Bob will use to communicate. –  user476 Aug 18 '11 at 23:51

It encrypts the time with the hash of the password, called long term key, so you get :

$$Ks(Hp(t), username)$$

-