What ist Kerberos au­then­ti­ca­tion and how does it work?

In an in­creas­ing­ly digitized world where private and com­mer­cial data is stored and trans­mit­ted elec­tron­i­cal­ly, cy­ber­crime is an ever-growing problem. Through the use of ar­ti­fi­cial in­tel­li­gence, hackers are finding more ways to optimize their attacks. For this reason, en­crypt­ing data through elec­tron­ic security pro­ce­dures is more important than ever. Find out what Kerberos au­then­ti­ca­tion is all about, how it works, and what its strengths and weak­ness­es are.

Kerberos is an au­then­ti­ca­tion service used in open or unsecure computer networks. Thus, the security protocol au­then­ti­cates service requests between two or more trusted hosts over an untrusted network such as the Internet. Cryp­to­graph­ic en­cryp­tion and a trusted third party are used to au­then­ti­cate client-server ap­pli­ca­tions and verify user iden­ti­ties.

Kerberos is main­tained as an open-source project by the Kerberos Con­sor­tium. It has its origins in the 1980s when the Mass­a­chu­setts Institute of Tech­nol­o­gy (MIT) developed the protocol for its Athena project at the time. Today, Kerberos is the standard Microsoft Windows au­tho­riza­tion tech­nol­o­gy. However, Kerberos im­ple­men­ta­tions exist for other operating systems such as Apple OS, FreeBSD, UNIX, and Linux. Microsoft in­tro­duced its version of the Kerberos protocol in Windows 2000. It became a standard protocol for websites and single sign-in im­ple­men­ta­tions across various platforms.

Users, computers, and services that use Kerberos rely on the KDC, which provides two functions in a single process: au­then­ti­ca­tion and ticketing. So-called “KDC tickets” au­then­ti­cate all parties by verifying the identity of all nodes – the starting and ending points of logical con­nec­tions. In doing so, the Kerberos au­then­ti­ca­tion process uses con­ven­tion­al shared-secret cryp­tog­ra­phy that prevents trans­mit­ted data packets from being read or modified. This also protects them from eavesdrop and replay attacks.

Kerberos and NTLM are network protocols that form a subgroup in the Internet Protocols (IPs) family. Both are au­then­ti­ca­tion methods that use TCP (Trans­mis­sion Control Protocol) or UDP (User Datagram Protocol). NTLM stands for NT LAN Manager and was developed before Kerberos. It is a challenge-response au­then­ti­ca­tion protocol in which the target computer requests a password, which is then verified and stored as password hashes for further use.

One of the main dif­fer­ences between Kerberos and NTLM is third-party ver­i­fi­ca­tion. In that way, Kerberos has a stronger en­cryp­tion function than NTLM because the extra step adds another layer of security. NTLM, meanwhile, can be cracked rel­a­tive­ly easily, which is why it is con­sid­ered insecure these days and should not be used. However, both au­then­ti­ca­tion protocols are still im­ple­ment­ed in the Windows au­then­ti­ca­tion module.

The Security Support Provider (SSP) Negotiate, which acts as the ap­pli­ca­tion layer between the Security Support Provider Interface (SSPI) and the other SSPs, au­to­mat­i­cal­ly chooses between Kerberos and NTLM au­then­ti­ca­tion in a ne­go­ti­a­tion process. If available, the Kerberos protocol is used, otherwise NTLM is used.

While Kerberos is usually im­ple­ment­ed in Microsoft products starting with Windows 2000 and Windows XP, there are other common security protocols for web browsing, messaging, and email. For example, the security protocol SSL or TLS encrypts the con­nec­tion between a web server and a browser. This ensures that all data trans­mit­ted remains protected and cannot be read. Just like Kerberos, SSL works with the TCP protocol, but uses a public-key en­cryp­tion method.

Kerberos is con­sid­er­ably more secure than NTLM. In fact, third-party au­tho­riza­tion makes it one of the most secure ver­i­fi­ca­tion protocols in the IT world. In addition, passwords are never shared in plain text. “Secret keys” are trans­mit­ted in the system only in encrypted form. Kerberos also makes it very easy to track who requested what and when.

Trans­par­ent and accurate logs are essential for security audits in or­ga­ni­za­tions of all sizes. They also have excellent access control to the log. What’s more, the service lets users and service systems au­then­ti­cate each other. At every step of the au­then­ti­ca­tion process, both users and server systems know they are dealing with an authentic coun­ter­part. And over the years, many security experts have tried to hack the open-source project, resulting in con­tin­u­ous im­prove­ments.

Naturally, Kerberos has some vul­ner­a­bil­i­ties. For example, if the Kerberos server fails, users cannot log in. Fallback au­then­ti­ca­tion mech­a­nisms and secondary servers often serve as a solution to this problem. There are also strict timing re­quire­ments: The date/time con­fig­u­ra­tions of the hosts involved must always be syn­chro­nized within pre­de­fined limits. Otherwise, au­then­ti­ca­tions fail because tickets are only available to a limited extent.

Some legacy systems are not com­pat­i­ble with third-party au­then­ti­ca­tion mech­a­nisms. And although the passwords in Kerberos au­then­ti­ca­tion are usually secure, they can now be cracked by hackers through brute force attacks or stolen through phishing attacks. This is one reason why mul­ti­fac­tor au­then­ti­ca­tion (MFA) is becoming an in­creas­ing­ly popular means of pro­tect­ing online iden­ti­ties.