RFC 4120 — Kerberos V5

Q: What does the Introduction section cover in RFC 4120 — Kerberos V5?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4120 — Kerberos V5. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Protocol Overview section cover in RFC 4120 — Kerberos V5?

The Protocol Overview section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4120 — Kerberos V5. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Ticket Structure section cover in RFC 4120 — Kerberos V5?

The Ticket Structure section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4120 — Kerberos V5. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Encryption Types section cover in RFC 4120 — Kerberos V5?

The Encryption Types section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4120 — Kerberos V5. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Cross-Realm Authentication section cover in RFC 4120 — Kerberos V5?

The Cross-Realm Authentication section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4120 — Kerberos V5. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 4120 — Kerberos V5

The Kerberos Network Authentication Service (V5) — ticket-based authentication protocol using symmetric key cryptography for mutual authentication between clients and services in untrusted networks.

Standards Track July 2005 ISO 27001

1. Introduction

▶

Kerberos V5 provides mutual authentication between a client and a server using a trusted third party — the Key Distribution Center (KDC). The protocol uses symmetric key cryptography to issue time-limited tickets that prove identity without transmitting passwords.

ISO 27001 Relevance: A.5.15 (Access Control) — Kerberos provides centralized authentication and authorization. A.8.5 (Secure Authentication) — ticket-based mutual authentication replaces password transmission.

2. Protocol Overview

▶

The Kerberos authentication exchange involves three sub-protocols:

AS Exchange: Client authenticates to KDC, receives Ticket-Granting Ticket (TGT)
TGS Exchange: Client presents TGT to obtain service tickets
AP Exchange: Client presents service ticket to application server

  Client            KDC (AS+TGS)         Service
    |                    |                   |
    |--- AS-REQ -------->|                   |
    |<-- AS-REP (TGT) --|                   |
    |                    |                   |
    |--- TGS-REQ ------->|                   |
    |<-- TGS-REP (ST) --|                   |
    |                    |                   |
    |--- AP-REQ (ST) ---------------------->|
    |<-- AP-REP ----------------------------|
    |                    |                   |

3. Ticket Structure

▶

A Kerberos ticket contains:

Field	Description	Security Role
tkt-vno	Ticket version (5)	Version negotiation
realm	Issuing realm	Trust domain identification
sname	Service principal name	Target service identity
enc-part	Encrypted ticket data	Contains session key, client name, authtime, flags

4. Encryption Types

▶

Kerberos V5 supports multiple encryption types. Modern deployments should use:

etype	Algorithm	ISO 27001 A.8.24
18	AES-256-CTS-HMAC-SHA1-96	RECOMMENDED
17	AES-128-CTS-HMAC-SHA1-96	Acceptable
23	RC4-HMAC	DEPRECATED — weak
3	DES-CBC-MD5	MUST NOT use

Security Note: RC4-HMAC (etype 23) and DES-based etypes have known weaknesses. ISO A.8.24 (Use of Cryptography) requires strong algorithms — enforce AES etypes.

5. Cross-Realm Authentication

▶

Kerberos supports cross-realm authentication through shared inter-realm keys. This allows users in one administrative domain to access services in another:

Direct trust: Realms share a direct inter-realm key
Transitive trust: Authentication can traverse a chain of trusted realms
PKINIT (RFC 4556): Public key authentication to KDC, eliminating password-based initial authentication

6. Security Considerations

▶

Replay protection: Timestamps and authenticator caching prevent replay attacks
Clock synchronization: Kerberos requires synchronized clocks (typically ±5 minutes) — see RFC 5905 (NTPv4)
Ticket lifetime: Limit ticket validity to reduce exposure window
Delegation: Constrained delegation limits which services can act on behalf of users
Pre-authentication: MUST be enabled to prevent offline password attacks