1
$\begingroup$

In the Kerberos protocol, the user sends his ID, the server (Or ticket granting server) ID and a nonce value. The Key Distribution Center uses a key (I assume symmetrical) derived from the client's password to send a message containing the session key between the client and the server and the same nonce. It also sends the ticket non-encrypted.

This exposes the protocol to dictionary attacks if the password is weak. An attacker can try to decipher the message sent by the KDC using the dictionary passwords and verify the result by checking if the nonce value is there.

I'm learning the Kerberos protocol and I'm confused by this weakness. It wouldn't be difficult to use the key derived from the user's password to establish a Diffie-Hellman key, and send the same message encrypted by the established key.

It completely solves the dictionary attack problem, and I can't see any downside.

Am I missing something?

$\endgroup$
1
  • $\begingroup$ "It wouldn't be difficult to use the key derived from the user's password to establish a Diffie-Hellman key". Really? That would be PAKE and it took SRP a lot of fixes and a long time to get there. $\endgroup$
    – fgrieu
    Feb 29, 2020 at 16:07

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.