1. CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina

2. 10/24/20072 Authentication Applications Developed to support application-level authentication and digital signatures A famous example is Kerberos – a password authentication service

3. 10/24/20073 Kerberos Trusted key server system from MIT Provide centralized password third-party authentication in a distributed network allow users access to services distributed through network without needing to trust all workstations instead all trust a central authentication server Two versions in use: 4 & 5

4. 10/24/20074 Kerberos Requirements First published report identified its requirements as security reliability transparency scalability Implemented using an authentication protocol based on Needham-Schroeder

5. 10/24/20075 Kerberos 4 Overview A basic third-party authentication scheme Have an Authentication Server (AS) users initially negotiate with AS to identify self AS provides a non-corruptible authentication credential (ticket granting ticket, TGT) Have a Ticket-Granting Server (TGS) users subsequently request access to other services from TGS on basis of users TGT

6. 10/24/20076 First Design (1)C  AS:ID c ||P c ||ID v (2)AS  C:Ticket (3)C  V:ID c ||Ticket Ticket = E K v [ID c ||AD c ||ID v ]

7. 10/24/20077 Problems with First Design User may have to submit password many times in the same logon session Password is transmitted in clear

8. 10/24/20078 Second Design Once per user logon session: (1)C  AS:ID c ||ID tgs (2)AS  C: E Kc [Ticket tgs ] Once per type of service: (3)C  TGS:ID c ||ID v ||Ticket tgs (4)TGS  C:Ticket v Once per service session: (5)C  V:ID c ||Ticket v Ticket tgs = E K tgs [ID c ||AD c ||ID tgs ||TS 1 ||Lifetime 1 ] Ticket v = E K v [ID c ||AD c ||ID v ||TS 2 ||Lifetime 2 ]

9. 10/24/20079 Problems with Second Design Requirement for server (TGS or application server) to verify that the person using a ticket is the same person to whom ticket was issued Requirement for server to authenticate themselves to users

10. 10/24/200710 Kerberos 4 Message Exchange

11. 10/24/200711 Kerberos 4 Overview

12. 10/24/200712 Kerberos Realms Kerberos environment consists of a Kerberos server a number of clients, all registered with server application servers, sharing keys with server This is termed a “realm” typically within a single administrative domain If have multiple realms, their Kerberos servers must share keys and trust each other

13. 10/24/200713 Request Service in Another Realm

14. 10/24/200714 Kerberos Version 5 Developed in mid 1990’s Provide improvements over Version 4 addresses environmental shortcomings encryption alg, network protocol, byte order, ticket lifetime, authentication forwarding, interrealm auth and technical deficiencies double encryption, non-std mode of use, session keys, password attacks Specified as Internet standard RFC 1510

15. 10/24/200715 Kerberos 5 Message Exchange

16. 10/24/200716 Next Class First student presentation! Submit your summary to dropbox before class My next lecture will be about Certificate and authorization Firewall and access control