World-Wide Web and Client-Server Authentication using Kerberos by Phoenix Malizia

Distributed System Communication Issues  Access Control –Authentication –Passwords  Encryption

Kerberos  Developed at MIT in mid-80s  Secret key encryption system –Encrypts data –Authenticates users  No unencrypted passwords transmitted

Kerberos Server  Authentication Server –Ensures client authenticity –Provides session key to TGS  Ticket-Granting Server –Develops session key for client-server interactions –Encrypts session keys with respective secret keys

Kerberos Communication

Kerberos Secret-Key Scheme Problem: Scalability My Solution: Public-Key Scheme

Public-Key Encryption  Public-Private Key Pair  Confidentiality –Encrypt with receiver’s public key  Authenticity –Encrypt with sender’s private key  Confidentiality and Authenticity –Double-Encrypt, first with sender’s private key, then with receiver’s public key

Public Key Kerberos – Initialization Phase  Kerberos Server publishes its public key  Users and service administrators create password, encrypt it with Kerberos server’s public key, and send back to Kerberos Server  For each Kerberos Server creates key pair, then encrypts private key with user’s password  Password discarded!!!

Public-Key Kerberos – Normal Usage  On login, Kerberos Client requests user’s private key file from Kerberos Server  User must provide client with password to access his private key  Client creates session key, doubly-encrypts it, and sends it to server  All hosts download public keys as needed; public keys are always encrypted using Kerberos Server’s private key to guarantee authenticity

Benefits  Public-Key caching reduces or eliminates queries to Kerberos Server  Caching is per-host, not per-user  Key rings can increase efficiency on small or mid-scale distributed systems  Public-Private key pairs have long expiration dates  Overall speed increase on distributed systems and the World Wide Web