Kerberos Protocol

While solving windows ctf boxes. I came across this interesting protocol named Kerberos and  I am very fond of knowing how it is actually working. So this article is about Kerberos and its working.

Introduction

The word Kerberos derived from greek methodology after the name of a three-headed dog that guarded the gates of Hades.
Kerberos is an authentication protocol that is responsible for authenticating users to the servers and servers to the users. The Kerberos protocol has four components: client, Authentication Server(AS),TGS(Ticket-Granting-Server),Server.
1. Client: Client or user is an entity which tries to access the services offered by the server.
2. AS: Authenticating Server is used for the verification of the user during login. Initially, each user needs to register themselves with the AS. After registration, each user gets a unique ID and password. The credential was stored in the centralized database of AS.
If the user is authenticated, AS will issue a ticket and session key. This ticket is proof that the user has been authenticated and the session key is used to contact the TGS. The AS also shares a unique key with the server. Hence every server also needs to register themselves with AS.
3. TGS: TGS generates a ticket for the establishment of the connection between the server and the client. The authenticated user can request the TGS for 'n' number of time to obtain the ticket for a different server.

Working of Kerberos Protocol 

Kerberos protocol

1. Initially, the client only passes the ID to the AS.
2. In response AS creates a message that consists of a ticket for TGS and session key (Ksession) to contact the TGS. This message is then encrypted with the symmetric key of A (K_SA). This encrypted message was sent back to A.
3. On receiving the encrypted message, A’s workstation asks the user for a password. If the password was entered correctly then workstation generates a symmetric key (K_SA). This symmetric key then decrypts the message received by A. ticket and session key is then extracted when the decryption is performed successfully.
A now sends a message to TGS which consists of the ticket received from AS, Server name (B), Timestamp (T). This message is encrypted with the session key(Ksession).
Note: Timestamp is used to prevent replay attacks from other users.
4. Now TGS sends 2 tickets each for A and B. Both tickets contains the session key(K_AB) to be used between A and B. A’s ticket is encrypted with the secret key (K_A) that is shared between A and TGS whereas B’s ticket is encrypted with the secret key (K_B) that is shared between B and TGS.
No other user has any idea about K_A and K_B so nobody could extract K_AB, that provides total security during the whole process.
5. Now A sends the B’s ticket with timestamp encrypted with K_AB.
6.B acknowledges the receipt of the ticket by adding 1 to the timestamp. I also encrypt the message with K_AB and sends it to A.

source - Express Learning: Cryptography and Network Security.