Tools / Cyber Security Interview Questions
Explain the internal working of Kerberos Authentication?
sequenceDiagram
participant C as Client
participant AS as Authentication Server
participant TGS as Ticket Granting Service
participant Svc as Service
C->>AS: Request TGT (login credentials)
AS->>C: Issue TGT
C->>TGS: Present TGT, request service ticket
TGS->>C: Issue service ticket
C->>Svc: Present service ticket
Svc->>C: Grant access
Kerberos is a ticket-based authentication protocol that lets a user prove their identity once and then access multiple services without re-entering credentials each time.
- The client authenticates once to the Authentication Server (AS) and receives a Ticket Granting Ticket (TGT), encrypted with a key derived from the user's password
- To access a specific service, the client presents the TGT to the Ticket Granting Service (TGS) and requests a service ticket
- The TGS issues a service ticket encrypted with that specific service's secret key
- The client presents the service ticket directly to the target service, which decrypts it with its own key to verify the client's identity without ever contacting the AS again
Because the actual password never travels across the network after the initial exchange, and tickets are time-limited, Kerberos significantly reduces the exposure of credentials compared to sending a password with every request. It's the authentication backbone of Microsoft Active Directory.
What does the client receive first from the Authentication Server?
Does the user's password travel across the network with every service request in Kerberos?
More Related questions...
