Kerberos (v4) limitations

• Encryption is not needed, but attacker can flood $\text{KAS}$ $A\to \text{KAS}:A,\text{TGS}$
• Double encryption is redundant (eliminated in Kerberos 5) $\text{KAS}\to A:\{K_{A,\text{TGS}},\text{TGS},{\mathcal{T}}_1,\{A,\text{TGS},K_{A,\text{TGS}},{\mathcal{T}}_1{\}}_{K_{\text{KAS,TGS}}}$
• Relies on synchronised and un-compromised clocks. If the host is compromised, clock can be manipulated for replay attacks.