3
$\begingroup$

When a user wants to communicate with another user (let's say Alice and Bob), what is sent over the network during the initial communication?

Alice uses her Kerberos client and enters her password and username.

Something which is not clear to me:

Will she send a message containing

  • time
  • username
  • hash of password

generated with the session key of the kerberos client and authentication server?

Or will she send a message to the AS containing

  • time
  • username

encrypted with Alice's password and this again encrypted with a session key?

Improve this question
$\endgroup$
0

2 Answers 2

Reset to default
6
$\begingroup$

If you look at RFC 1510, (an overview and specification of Version 5 of the Kerberos network authentication system), the initial exchange involves the client (Bob) sending its own identity, and the identity of the server (Alice) for which it is requesting credentials in cleartext. The response contains a ticket for the client to present to the server, and a session key that will be shared by the client and server. The session key and additional information are encrypted using the client's secret key (which is stored on the Authentication Server).

The request message contains the client's principal name as well as the server's principal name, the time and a nonce to prevent replays. The reply message contains information which can be used to detect replays, and to associate it with the message to which it replies.

In the normal case, the authentication server does not know whether or not the client is actually the principal named in the request. It simply sends a reply without knowing or caring whether or not they are the same. This is acceptable since nobody but the requesting principal (client) will be able to decode the reply.

For further information, have a look at Section 3 - Message Exchange of RFC 1510.

Improve this answer
$\endgroup$
2
  • $\begingroup$ No no, I meant I am Alice I want to talk to Bob, we still have the ticket granting service and authentication service. When Authenticating with the kerberos client to the AS, you send a message containing the current timestamp and your username. I knew the password fitted in somewhere but I didn't know where anymore :). $\endgroup$
    – Lucas Kauffman
    Commented Aug 18, 2011 at 16:29
  • $\begingroup$ The simple answer to your question is no, your password is not transmitted at any time since the hash of your password is kept on the Authentication Server. The Authentication Server uses this to encrypt the ticket and the session key that Alice and Bob will use to communicate. $\endgroup$
    – user476
    Commented Aug 18, 2011 at 23:51
4
$\begingroup$

It encrypts the time with the hash of the password, called long term key, so you get :

$$Ks(Hp(t), username)$$

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.