Kerberos
By MIT
Kerberos is a network authentication protocol developed at MIT that uses symmetric-key cryptography and a trusted third party to let users and services prove their identity to each other over an untrusted network without transmitting…
Definition
Kerberos is a network authentication protocol developed at MIT that uses symmetric-key cryptography and a trusted third party to let users and services prove their identity to each other over an untrusted network without transmitting passwords. It issues time-limited tickets instead of repeatedly sending credentials, and it remains the core authentication protocol behind Microsoft Active Directory and many Unix and enterprise network environments.
Overview
Kerberos was designed to solve authentication over a network where messages can be intercepted, meaning a system cannot simply send a password across the wire every time a user wants to access a service. Instead of trusting the network itself, Kerberos relies on a trusted third party, the Key Distribution Center, that both the user and the service already trust, and uses that trust to issue short-lived tickets that prove identity without ever exposing the underlying secret again after initial login. Mechanically, the Key Distribution Center is split into two logical parts: the Authentication Server, which verifies a user's initial login and issues a Ticket Granting Ticket, and the Ticket Granting Server, which uses that ticket to issue service-specific tickets on demand. When a user logs in, their password is used locally to decrypt a response from the Authentication Server without ever being sent over the network; from that point on, the user presents their Ticket Granting Ticket to request access to any individual service, and the Ticket Granting Server issues a service ticket encrypted with a key that only that specific service knows. The service can then verify the ticket without contacting the Key Distribution Center directly, which is what makes Kerberos fast for repeated access across many services in one session. Kerberos differs from LDAP in that LDAP is a directory lookup protocol while Kerberos is specifically an authentication protocol; in practice, Active Directory environments use them together, with Kerberos handling the actual proof of identity and LDAP handling directory queries about users and groups. Compared to newer federated protocols like SAML or OAuth 2.0, Kerberos is designed for trusted internal network domains rather than cross-organization federation over the open web, and it assumes reasonably synchronized clocks across all participating machines, since tickets are time-stamped and expire. In practice, Kerberos underlies single sign-on within Windows domains, letting a user log in once to their workstation and then transparently access file shares, email servers, and internal applications without re-entering credentials. Unix and Linux environments also use Kerberos, often through implementations like MIT Kerberos or Heimdal, particularly in academic and research computing environments where it originated. Its main limitations are operational: it requires reasonably synchronized clocks, a compromised Key Distribution Center compromises the entire realm, and it was not designed for authentication across the open internet or between organizations that do not share a trust relationship, which is why it is mostly confined to internal networks rather than public-facing web authentication.
Specification
- Trusted third-party Key Distribution Center issues time-limited tickets
- Passwords never transmitted across the network after initial login
- Ticket Granting Ticket enables single sign-on across multiple services
- Symmetric-key cryptography secures tickets between client and service
- Requires synchronized clocks across participants due to ticket expiration
- Core authentication protocol underlying Microsoft Active Directory domains
- Originated in Unix and academic computing before enterprise adoption