Kerberos (protocol)

Kerberos (pronounced "kur-ber-uhs") is a computer network authentication protocol, which allows people communicating over a non-secure network to prove their identity to one another in a secure manner. It is also a suite of free software published by Massachusetts Institute of Technology (MIT) that implements this protocol. Its designers aimed primarily at a client-server model, and it provides mutual authentication — both the user and the server verify each other's identity. Kerberos protocol messages are protected against spying and replay attacks.
Kerberos performs authentication as a trusted third party authentication service by using cryptographic shared secret under the assumption that packets traveling along the insecure network can be read, modified, and inserted. Kerberos builds on symmetric-key cryptography and requires a key distribution center. Extensions to Kerberos can provide for the use of public-key cryptography during certain phases of authentication.
History and development.
MIT developed Kerberos to protect network services provided by Project Athena. The protocol was named after the Greek mythological character "Kerberos" (or "Cerberus"), known in Greek mythology as being the monstrous three-headed guard dog of Hades. Several versions of the protocol exist; versions 1–3 used only internally at MIT.
Steve Miller and Clifford Neuman , the primary designers of Kerberos version 4 (which used the DES encryption algorithm with 56-bit keys),
published that version in 1989, although they had targeted it primarily for Project Athena. 
Version 5, designed by John Kohl and Clifford Neuman, appeared as in 1993 (made obsolete by in 2005), with the intention of overcoming the limitations and security problems of Version 4. The MIT makes an implementation of Kerberos Version 5 freely available, under a software license similar to that used by BSD license.
Several companies used Kerberos Version 5 in commercial software including:
In 2005, the IETF Kerberos working group introduced a new updated specifications for Kerberos Version 5 . updates include:
In 2007, MIT formed the Kerberos Consortium for continuation of development.
Protocol.
Kerberos uses as its basis the Needham-Schroeder protocol. It makes use of a trusted third party authentication known as "key distribution center (KDC)", which consists of two logically separate parts: an Authentication Server (AS) and a Ticket Granting Server (TGS). Kerberos works on the basis of "tickets" (called Kerberos tickets) which serve to prove the identity of users.
Kerberos database: The key distribution center (KDC) maintains a database of secret keys; each entity on the network — whether a client or a server — shares a secret key known only to itself and to the KDC. Knowledge of this key serves to prove the identity of each entity. For communication between two entities, the KDC generates a session key which they can use to secure their communications.
The term "Kerberos server" generally refers to the KDC. For reliability purposes, it is possible to have backup KDCs. These are referred to as "Kerberos slave servers". All slaves synchronize their databases from the master Kerberos server.
The term "Kerberized application server" generally refers to Kerberized programs that clients communicate with using Kerberos tickets for authentication. For example, the Kerberos telnet server is an example of a Kerberized application server . While the term "Kerberized applications" is used to referrer to the client side of Kerberized application server , For example, the Kerberos telnet client is an example of a Kerberized applications
The security of the protocol depends heavily on:
Simplified description of the protocol.
The following abbreviations will be used:
Briefly, the client authenticates to AS using a long-term "shared secret" and receives a ticket from the AS. Later the client can use this ticket to get additional tickets for SS using the same shared secret. These tickets can be used to prove authentication to SS.
The protocol in more detail.
User Client-based Logon Steps:
Client Authentication Steps:
Client Service Authorization Steps:
Client Service Request Steps: