A network authentication protocol that uses tickets to verify identities, Kerberos relies on the Ticket-Granting Service (TGS) to issue service tickets after a user authenticates with the Authentication Server (AS). This two-step process enhances security by separating initial user authentication from subsequent service access requests.
How TGS Works
The TGS receives a Ticket-Granting Ticket (TGT) from the AS and issues service tickets for specific services. This ensures that only authenticated users can access network resources.
- Initial Authentication: The AS issues a TGT to the user after verifying credentials.
- Service Ticket Request: The user presents the TGT to the TGS to request access to a specific service.
- Service Ticket Issuance: The TGS validates the TGT and issues a service-specific ticket, allowing the user to access the requested service.
Security Features
Kerberos protects against eavesdropping and replay attacks through cryptographic techniques. The TGS plays a crucial role in this security framework by ensuring that only valid TGTs can request service tickets.
- Mutual Authentication: Both the user and the service verify each other's identity.
- Ticket Encryption: Tickets are encrypted to prevent tampering and unauthorized access.
Protocol Details
Kerberos operates over UDP port 88 by default. The protocol's design aims to provide secure communication over non-secure networks, making it suitable for various client-server models.
- Symmetric-Key Cryptography: Kerberos primarily uses symmetric-key cryptography for ticket encryption.
- Trusted Third Party: The protocol relies on a trusted third party to manage authentication tickets.