Chapter 23 - Internet Authentication Applications

Kerberos

A standard, public-domain-based remote authentication protocol developed by MIT that uses a trusted third party to verify identities.

Kerberos anatomy

• client - person that request authentication

• application - resource client tries to access

• Kerberos - in between client + app

  • Kerberos authentication server

  • Kerberos ticketing server

Man-in-the-middle attacks

Unsecured networks that are susceptible to interception, putting sensitive data at risk.

Ticket Granting Ticket (TGT)

An encrypted ticket that contains the session key and message, allowing access to applications without sending passwords over an insecure network.

Authentication server

The server that verifies the identity of clients in the Kerberos protocol.

Ticket Granting Server (TGS)

The server that encrypts the TGT with the session key and grants access to services.

3 Step TGT exchanges

• client authentication request: client logs in + requests application → authentication server → once match TGT → sends TGT back to client

• authentication server response: client sends TGT to ticketing server → TGS further encrypts with session key → validates and grants TGT back to client

• client sends TGT to application server → application creates a service ticket → client sends ticket to host

Version 5 Kerberos

An updated version of Kerberos that improved scalability and used AES instead of DES.

Certificate Authority (CA)

A trusted entity that assigns public keys to owners to prevent impersonation.

Certificate

Created by a trusted, third party that actually binds the key w/ its owner

X.509

The digital standard for public key certificates

X.509 anatomy

• subject

• public key

• issuer

• validity,

• digital signature.

Public Key Infrastructure (PKI)

The framework that includes all assets necessary for creating, managing, and distributing public keys.

Short-lived certificates

Certificates with limited validity that require frequent renewal.

Attribute certificates

Certificates that have validity based on roles or attributes rather than identity.

Proxy Certificates

Certificates that address short-lived certificate demerits and are acknowledged using extensions

Public Key Infrastructure (PKI)

all assets that create public keys including:

• CA

• Registration Authority (RA) - authenticates a certificate that refers to CA

• Digital Certificates

• Trust Store - repository of all the certificates (includes unused certificates)