\input texinfo    @c -*-para-*-
@setfilename works.info
@settitle How Kerberos Works

@node top,
@chapter Kerberos Design

One of the important features of Kerberos is that it has a published
specification and implementation. This means that it is possible to
audit it, and reason about the behavior of Kerberos in response to both
normal operation and particular attacks. 

@menu
* Shared Secrets::		Shared Secrets are the basis of
				authentication.
* Transitive Trust::		Secretly passing a secret.
* Authentication::		What precisely is being authenticated.
* Authorization::		Authorization is application specific
* Encryption::			Application level encryption
@end menu

@node Shared Secrets, Transitive Trust, , top
@chapter Shared Secrets are the basis of authentication.

Kerberos Authentication centers around a secure database (the Key
Distribution Center) which stores a secret for each user and service.
This secret currently takes the form of a DES encryption key. Since
these keys are only shared with the database and one other party, the
server can produce private messages that can only be read by the party
whose key is used to encrypt it. Thus a recipient can "prove" that they
have a given key, and are therefore the correct recipient, by
successfully decrypting a particular message from the server.

@node Transitive Trust, Authentication, Shared Secrets, top
@chapter Secretly passing a secret.

Given a secret key KA shared between principal A and the server, and
another KB between service B and the server, the server can encrypt a
message in KB and then in KA, and hand it to principal A. They then
need to decrypt the message, using KA; noone else can do this, as noone
else is supposed to know KA.
	Principal A can then hand the resulting message to service B,
which decrypts it using KB. If it succeeds (based on the contents of the
resulting message, the original sealed at the server) it knows that the
message came via someone who possesses KA and is therefore A. 
	Protecting the message being passed requires a small amount of
additional information; in Kerberos V4, this is a an 8 byte checksum
value. This value is passed to the server when requesting a ticket; it
is sealed inside the ticket, so that the final recipient can examine the
value and use it to determine if the message body has been tampered with.

@node Authentication, Authorization, Transitive Trust, top
@chapter What precisely is being authenticated.

Any reasoning about Kerberos is limited by the fact that the proof is
that a given secret (password) has been presented. It cannot protect
against theft of a password from the outside -- if someone sees you
type your password, or if you write it down somewhere, the assumption
that you are the only holder of the key is no longer valid.

@node Authorization, Encryption, Authentication, top
@chapter Authorization is application specific

While Kerberos provides the mechanism for authentication from one
principal to another, it does not handle authorization. Kerberos only
indicates that a given entity posesses a given key, and therefore is
recognized by a given Kerberos name. Once the application has been
informed of this name, it has to decide for itself whether to grant
access to the user, and how much access.


@node Encryption,  , Authorization, top
@chapter Application level encryption

Applications can use Kerberos to securely pass an encryption key to both
ends of a connection. This key can then be used to encrypt the rest of
the session for applications that need privacy as well as integrity. 
	Various existing applications use different modes of DES for
encryption (since it is application specific, an application could use
another algorithm, though DES is believed to be the strongest
available.) 
	rlogin and rcp use Permuted Cipher Block Chaining, a
modification of the FIPS specified Cipher Block Chaining algorithm
(though PCBC turns out not to provide further integrity.) If the data
available is less than the 8-byte block size, rlogin and rcp pad the
data in different ways.
	telnet has been modified to support both Cipher Feedback and
Output Feedback modes of DES, to optionally encrypt the input and/or
output streams.

@bye
