Kerberos (contd)
- Ticket granting server (TGS): gives access to specific servers to authenticated users
- Secret key database
Strong authentication:
- User sends login name; AS sends TGT (w/ secret key based upon user’s password)
- User enters password; and workstation attempts to decrypt TGT using this password. After decryption, user gets also a session key
- Send an “authenticator” to TGS. Encrypted w/ session key (a shared secret w/ TGS), plus name of server, TGT, and timestamps.