1. Kerberos + X.500 for Secure Initial Network-wide Login Ann Ann, pswd A KDS logon(Ann) K A {S A, TGT} GenerateS A at random; Get K A =hash(pwsd) from X.500 DDS; TGT = K KDS {A, S A } X.500 DDS Client stores user acct. DB + secret keys+ other attributes LDAP K A =hash(p wsd); Cache S A, TGT; Delete K A Also stores attributes: tGTLifetime, krbMasterKey, sessionLifetime, in user account.

2. Kerberos + X.500 for Secure Network- wide Login + Application Ann Ann’s Workstation caches TGT and session ticket Ann, passwd A KDS Bryan gets verifies session tkt. App Server logon(Ann, password A ) Here’s TGT Needs session tkt for Bryan Here’s session tkt for Bryan Can get userID and password of all principals. Generates TGT and session tickets. Ann wants to talk to you; Here is the session tkt OK X.500 DDS Client stores user acct. DB + other attributes LDAP Wants to do remote app. on Bryan

3. Kerberos Tickets TICKET, NAME, AUTHENTICATOR Ticket consists of ? –{ s, c, addr, created timestamp, lifetime, Ks,c }Ks Note: Ks,c is the session key; The entire ticket is encrypted with Ks, the server key, because it is destined for the TGS. Names look like? –Name.instance@realm –ghansah.gaia@csus.edu –ghansah.root@csus.edu (domain wide root) Authenticator consists of? –{ c, addr, timestamp } Ks,c The authenticator is shorter than a ticket and is, therefore, preferred for performance reasons by the client when sending messages. The timestamp is a nonce.

4. Kerberos + X.500 for Secure Network- wide Login + Application - TECH. DETAILS Ann Ann’s Workstation Ann, passwd A KDS Bryan gets K A-B Verifies t,.. App Server Ann needs TGT K A {S A, TGT} TGT, S A {t} S A {B,K A-B, tkt B } Knows K A = f(passwd A ) Invents S A. TGT = K KDS {A, S A } Invents K A-B tkt B =K B {A,K A-B } tkt B, K A-B {t} K A-B {t+1} X.500 DDS Client stores user acct. DB eg. passwd A LDAP rlogin, ftp, telnet Bryan

5. Kerberos + X.500 + Public Key for Secure Network-wide Login + Application Ann Ann’s Workstation caches TGT and session ticket Ann, passwd A KDS Bryan gets, verifies session tkt. App Server logon(Ann),SIG Here’s TGT Needs session tkt for Bryan Here’s session tkt for Bryan Get KPubA from X.500 DDS; Verify SIG; Send TGT. Generates TGT and session tickets. Ann wants to talk to you; Here is the session tkt OK X.500 DDS Client stores user acct. DB + Public Key Certs. + other attributes LDAP Wants to do remote app. on Bryan CA Issues Certs To Ann