Secure Chapter 13 & 14
Kerberos V4
Kerberos is a private key which is reliant on service for issuing verification in a network. It was created in MIT, and centered on undertakings by Needham and Schroeder Mediated Authentication. It applied version 4 and 5; 4 has bigger installed base, easy and good performance though applied with TCP/IP networks, 5 has bigger operability.
Its implementation involves the Key Distribution Center which operates on a safe node and a collection of smaller paths applied through distributed applications which desire to verify users. It applies certain applications in their paths; telnet, BSD, and NFS.
In ticketing and ticket-granting ticket, the KDC shares a private key, master key per user. The initial version of Kerberos, 2 and 3, did not apply the TGT. The client’s master key was constantly applied when interacting with the KDC. Later, for improved safety, the aspect of acquiring smaller-lifetime period key when login in was put in place (Chapter 13: Kerberos V4, 2012). This was based on that TGT was acquired from KDC, and other tickets were acquired from a contrasting body that Kerberos termed as Ticket-Granting Server (TGS). The database used though is similar as KDC.
While configuring, every set of private key has a master key for the user. The KDC is the Kerberos server or a verification server. The KDC has a worksheet of names of the users and their master keys. The master key is kept encoded using a key that is private of the KDC called KDC master key for safety. It is acquired from the client’s password. The Kerberos is reliant on the secret key technology and applied DES. The version 5 applied fields for noting the cryptographic method. The DES is not applied as it lacks applications of Kerberos with the ability to apply varied methods.
As one logs in to a network, the user will have to acquire the session key and TGT. These are sent to the workstation encoded with the user’s master key. The workstation transforms the password of the user into a DES key. After acquiring the credentials, it tries to decode using the DES key. If it goes through then the workstation does away the user’s key and keeping the TGT and session key.
The version 4 does not ask the client for password till it acquires the credentials from the KDC. Since Kerberos version 4 has better security for acquiring the client’s password for the smallest time possible. Version 5 acquires the credentials then gets the password so that the workstation proves that it recognizes the client’s password.
The objective of the TGT is that it has the data that the KDC requires on the client login session. This makes it possible for KDC to work with no unstable information. This makes it for possible several operational benefits for instance duplicating the KDC.
When the user desires to interact, the workstation directs to KDC the TGT the name of the second user, say Bob and a verifier with ascertains that the terminal recognizes the session key. This is called KRB_TGS_REQ and the response KSB_TGS_REP. with the application of the verifiers it is important to synchronize the time.
Problem is having one KDC hence hard to access remote sources. Hence better to have many KDCs for interchange. The multiple will do away with performance bottleneck in the KDC. The only threat is reorganization of information. The several KDC are divided into realms with a master key. For one realm to access another realm there has to be verification this is backed by Kerberos. The Kerberos has version keys so as to know the varied versions hence to know what password to offer. The information applied by Kerberos is encoded for security; this is done in CBC mode. The encoding may also be done for integrity. The network layer is addressed to hinder issuance of ticket and session key to another user and stop intrusion of another user.
Version 5
In Kerberos version 5, the ASN.1 is information representation language made consistent by ISO. It is applied with the Basic Encoding Rules. It has overhead adding to its dynamic nature which may be avoided.
The naming in version 5 consists of realm and name. With this there is the allocation of rights one is allowed to access. This may be done by issuing tickets. In this version it is done by requesting for TGT with an address. Its benefit is that it allows the KDC audit the delegation activities. The audit when there is a breach will inform on the nodes that had access to the resources. The disadvantage is on performance. The TGT has flags that determine if a request is to be allowed.
The tickets have lifetimes that are unlimited. The risk is that they are irrevocable. These tickets may also be renewed hence stays longer. The tickets allows for postdated ticketing where in offering of ticket with a terminating time with two hours added from the current time. To make it invalid there is a flag.
The keys or of varied versions letting the user know which to use till it expires. Version 5 has the ability of creating maser keys in the varied realms making it hard to copy it. It does not work if there is acquisition of the user’s password. Version 5 has fields removed; encryption. The version is created modularly to permit insertion of varied encoding methods. The methods applied for protection were based on integrity where if one is a cryptographic compromised there is use of another one. The encryption applied additionally increases privacy.
The hierarchy of the realms in in this version permits the use of varied realms for verification. It may be termed to as flexible and trustworthy based on the users. Every user will have their own policy to accord their trust. These policies may be to arrange them for each parent for several children.
When accessing network individuals guess, this is stopped in version 5 using preauthentication-data this requests for a TGT to ask for a ticket to the main user. The password guessing attack is stopped by marking database entries for the principals. One hence does not acquire ticket for a resulting master key from a password.
A user has the ability use varied authenticators for varied interactions with an involved session key. The authentication also may involve the sending of two TGTs to KDC.
The design center for Kerberos has users with passwords and servers of high quality private keys shared to KDC. The PKI is the easiest which Kerberos applies for KDC for a client’s public key in the database. The TGS_REP message is taken to the client encoded in the public key.
The KDC database is composed of the name of user, master key, version key, lifetime, and the entry expires of database, as well as the modification entry among others.
References
Anonymous (2012). Chapter 13: Kerberos V4 & Chapter 14: Kerberos V5.
