Kerberos V5

 

转载请注明出处：http://blog.youkuaiyun.com/zhangyang0402/archive/2010/06/06/5650150.aspx

一、Overview

Kerberos 是一个认证协议，在RFC 1510, 4120中定义

 

二、Basic Authentication Concepts

    1. KDC - Key Distribution Center , installed in DC by default

       (1)AS  - Authentication Server

       (2)TGS - Ticket-Granting Server

    2. Master key - long-term key, = Hash(password)

    3. Session key - short-term key

    4. TGT -Ticket-Granting Ticket

    5. Sub-protocols

        (1)Authentication Service Exchange (AS Exchange)

        (2)Ticket-Granting Service Exchange (TGS Exchange)

        (3)Client/Server Exchange (CS Exchange)

 

三、Authentication process

 

1. AS exchange

这个exchange一般是在域用户登录到域的时候产生，成功登录到域的用户将获得一个TGT，这个ticket的有效期为8小时，当超过8小时或用户注销，该ticket不再有效。

 

1.1 KRB_AS_REQ (Client->AS)

identities of client and AS+[pre-authentication]

 

1.2 KRB_AS_REP (AS->Client)

 

session key (client-KDC)               ->encrypted by client master key

TGT(client-TGS)                           ->encrypted by KDC master key

 

 

2.TGS exchange

 

2.1 KRB_TGS_REQ (Client->TGS)

TGT(client-TGS)                           ->forward to TGS

Authenticator                                 ->encrypted by session key(client-KDC)

   

2.2 KRB_TGS_REP(TGS->Client)

 

session key (client-server)              ->encrypted by session key(client-KDC)

ticket(client-server)                        ->encrypted by sever master key

 

 

3. CS exchange

 

3.1 Client->Server    KRB_AP_REQ

 

ticket(client-server)                        ->forward to server

authenticator                                  ->encrypted by session key(client-server)

 

3.2 Server->Client    KRB_AP_REP

timestamp                                      ->encrypted by session key(client-server)

 

4. 总的认证过程如下图所示