Kerberos is a very well-known key distribution protocol, and it also has the function of an authentication protocol. It is also a KDC (Key Distribution Center). Kerberos uses AES for encryption, so it is more secure.
How Kerberos works
The core idea is this: Just like our usual life, when I need to go to the community center to stamp some stamps, the community center often requires you to provide a certificate proving that you are you. Usually you need to find the police station to issue such a certificate. So this AS is like a police station, and TGS is like a community center.
Introduction to key terms
AS (Authentication Server): authentication server, used to verify user identity
TGS (Ticket-Granting Server): ticket-granting server, used to provide credentials between two users
KA: this is A’s own key K_A: this is A own keyKA:This is A self own the secret key
KS: This is a communication with the session key K_S A TGS used: A TGS session key that is used to communicate withKS:This is A and T G S through the channel with the will then secret key
KTG: This is TGS own key K_ {TG}: This is TGS own keyKTG:This is T G S from own the secret key
T: timestamp T: time stampT:When inter- stamp
KB: This is your own key B K_B: This is your own key BKB:This is B from the own of the secret key
KAB: This is the A to B communicate with the session key K_ {AB}: This is the session key A and B communicate withKA B:This is the A to B through the channel with the will words secret key
specific process
- First, A sends a plaintext to AS. This plaintext proves that A is A. Because AS has filed A's information in advance, AS can verify A's information.
- AS verifies that A is A, then encrypts it with A's key, and sends to A the session key K_AS between A and TGS and A and K_S used to verify the identity of A for TGS, and the verification information provided to TGS by A Encrypted by K_TG, so that A cannot be decrypted, only when A is passed to TGS, TGS can perform decryption verification
- Next, A sends two pieces of information to TGS, one is the timestamp encrypted with their session key, the timestamp is used to prevent replay attacks, and the other is the ticket just now
- After TGS verified the ticket, TGS sent to A the ticket for B to verify A, as well as B’s information and the encryption key between A and B
- Next, A passes a timestamp to B, and a ticket to B
- B After verification, a timestamp +1 is returned
After the above steps, it can be seen that A and B have obtained the key for communication between the two parties.