Kerberos (v4) protocol

Authentication phase

1. $A\to \text{KAS}$: $A,\text{TGS}$
2. $\text{KAS}\to A:\{K_{A,\text{TGS}},\text{TGS},T_1,\underset{\text{AuthTicket}}{\underbrace{\{A,\text{TGS},K_{A,\text{TGS}},T_1{\}}_{K_{\text{KAS}},\text{TGS}}}}{\}}_{K_{\text{AS}}}$

• $A$ logs onto workstation and requests network resources.
• $\text{KAS}$ accesses database and sends $A$ a session key $A,\text{TGS}$ and an encrypted ticket $\text{AuthTicket}$.
• $K_{A,\text{TGS}}$ has lifetime of several hours (depending on application) as specified by timestamp $T_1$. $K_{\text{AS}}$ is derived from user’s password. Both user and server keys must be registered in database.
• $A$ types password on workstation to decrypt results, which are stored for session. $A$ is logged out when $K_{A,\text{TGS}}$ expires.

Authorization phase 3. $A\to \text{TGS}:\underset{\text{AuthTicket}}{\underbrace{\{A,\text{TGS},K_{A,\text{TGS}},T_1{\}}_{K_{\text{KAS}},\text{TGS}}}},\underset{\text{authenticator}}{\underbrace{\{A,T_2{\}}_{K_{A,\text{TGS}}}}},B$ 4. $\text{TGS}\to A:\{K_{AB},B,T_3,\underset{\text{ServTicket}}{\underbrace{\{A,B,K_{AB},T_3{\}}_{K_B,\text{TGS}}}}{\}}_{K_{A,\text{TGS}}}$

Before $A$‘s first access of resource managed by the server $B$:

• $A$ presents $\text{AuthTicket}$ from message $2$ to $\text{TGS}$ together with a new $\text{authenticator}$ with a short liftetime as specified by $T_2$.
  • The authenticator prevents replay attacks by having a short validity.
  • Servers store recent authenticators to prevent immediate replay attacks.
• $\text{TGS}$ issues $A$ a new session key $K_{\text{AB}}$ (with a lifetime of a few minutes as specified by $T_3$) and a new ticket $\text{ServTicket}$ where $K_{B,\text{TGS}}$ is a key shared between $\text{TGS}$ and $B$.

Service phase 5. $A\to B:\underset{\text{ServTicket}}{\underbrace{\{A,B,K_{AB},T_3{\}}_{K_B,\text{TGS}}}},\underset{\text{authenticator}}{\underbrace{\{A,T_4{\}}_{K_{A,\text{TGS}}}}}$ 6. $B\to A:\{T_4+1{\}}_{K_{AB}}$

For $A$ to access resources managed by $B$:

• $A$ presents a ticket from $4$ to $B$ along with a new authenticator.
• $B$ replies (optional), authenticating service.