🎫Kerberos

NEW

A network authentication protocol using tickets and secret-key cryptography to provide mutual authentication for client–server applications.

DESCRIPTION

Kerberos authenticates clients to services via a trusted Key Distribution Center (KDC), issuing time-bound tickets. Clients obtain a Ticket Granting Ticket (TGT) from the Authentication Service, then request service tickets from the Ticket Granting Service. Mutual authentication and replay resistance rely on shared secrets and time synchronization. Kerberos underpins single sign-on in many enterprises, especially with Active Directory. Strong key algorithms and proper clock synchronization are critical to security.

ALTERNATIVE DEFINITIONS

MIT Kerberos

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography.

Stresses strong authentication with secret-key cryptography.

Source

Wikipedia

Kerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

Highlights ticket-based operation over untrusted networks.

Source

RELATED TERMS

Key Distribution Center Ticket Granting Ticket Service Ticket Active Directory GSSAPI SPNEGO Single Sign-On Mutual Authentication Time Synchronization Rijndael

COMPETING TERMS

NTLM

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer IT Manager Cloud Architect Application Administrator

EXTERNAL SOURCES

• Wikipedia - Kerberos (protocol)
• IETF - Kerberos V5 protocol specification.
• Microsoft Learn - Kerberos in Windows and Active Directory.
• MIT Kerberos - MIT Kerberos documentation set.

TOP QUESTIONS

How does Kerberos achieve mutual authentication?

Both client and server prove knowledge of secrets tied to tickets issued by the KDC, preventing impersonation and replay.

Category: Concept

What is a Ticket Granting Ticket in Kerberos?

A TGT is issued by the KDC’s Authentication Service and lets clients request service tickets without re-entering credentials.

Category: Concept

Why is time synchronization important in Kerberos?

Ticket validity and replay protection rely on clocks being closely synchronized between clients, servers, and the KDC.

Category: Requirements

How does Kerberos compare to NTLM?

Kerberos offers stronger, ticket-based mutual authentication and better scalability; NTLM is legacy and weaker.

Category: Comparison

What are common mistakes when deploying Kerberos?

Misconfigured SPNs, clock skew, weak encryption types, and duplicate service accounts commonly cause failures.

Category: Mistakes

Can Kerberos support single sign-on for web apps?

Yes, through SPNEGO/GSSAPI, browsers can obtain and present tickets for seamless SSO in enterprise environments.

Category: Example

What is the biggest risk in Kerberos environments?

Compromise of the KDC or highly privileged accounts can undermine domain-wide trust.

Category: Risks

What is a hot topic around Kerberos today?

Hardening against Golden/Silver Ticket attacks and adopting AES-based encryption with modern domain functional levels.

Category: Topic

How do service principals work in Kerberos?

Service Principal Names map services to accounts; correct SPN registration enables ticket issuance and validation.

Category: Concept