Learning Kerberos Authentication

I am currently learning about the Kerberos authentication protocol. I was first introduced to Kerberos while studying for the CompTIA Security+ certification, but now I am going to dive deeper into Kerberos through TryHackMe's Cyber Security 101 certification to better understand how Kerberos authentication works and how it is used in cybersecurity.

Let's say you want to connect to a database so that you can update some data for your business. You would first need to authenticate to the domain.

The user authenticates to the Domain Controller using their username and password. The Domain Controller provides the Key Distribution Center (KDC), which is responsible for handling Kerberos authentication.

When the user enters their username and password, the system uses the password to derive a cryptographic key. The user's password itself is not sent directly to the KDC.

The user's computer then sends an authentication request to the KDC. The request contains the user's username and other information used during the authentication process.

The client also sends protected authentication information that contains a timestamp. The timestamp helps the KDC verify that the authentication request is valid and recent.

The KDC has the corresponding cryptographic key for the user's account. It uses this key to verify the protected authentication information.

If the user entered the correct password, the user's computer will have derived the correct cryptographic key, allowing the authentication information to be successfully verified.

If the user entered the wrong password, the computer will derive the wrong cryptographic key, and the authentication information will fail verification.

This means that the user's password does not have to be sent directly to the KDC. Instead, the password is used to derive a cryptographic key that is used as part of the authentication process.

Receiving the Ticket-Granting Ticket

Once the Authentication Service has authenticated the user, it sends the user a Ticket-Granting Ticket (TGT).

The user also receives a session key as part of this process.

The TGT can be thought of like being given a general key for a building. It does not mean that the user can automatically access every area. If the user wants to access a specific service, they need to make another request for that service.

How Does the Client Get a TGS?

The TGS stands for Ticket-Granting Service.

For example, if the user wants to access a specific database or a print server, they need to request access to that specific service.

The user has already entered their username and password, so they do not need to enter their password again. The client uses the Ticket-Granting Ticket (TGT) it received earlier when making the request.

The client sends the request to the Ticket-Granting Service (TGS) and tells it what service it wants to access. This is done using an SPN, which stands for Service Principal Name.

The SPN identifies the specific service the user wants to access. For example, it is not simply saying, "I want to access the print server." The request needs to specify which particular print server or service the user wants to access.

Receiving the Service Ticket

The Ticket-Granting Service responds to the request by sending back a service ticket and a service session key.

When the client needs to access the requested service, such as a print server, it uses the service ticket when contacting that specific print server to authenticate to the service.

The service session key is used as part of the authentication and communication between the client and the print server.

The service ticket and service session key are both provided to the client by the Ticket-Granting Service as part of its response.

Conclusion

In summary, I am still learning about Kerberos, but I now have a basic understanding of how Kerberos authenticates users and how a user is able to authenticate to a service identified by a Service Principal Name (SPN).

This is a fascinating topic, and I will be learning about how Kerberos can be attacked in the future, including an attack known as Kerberoasting.

Thank you for reading!