Kerberos
Definition
An MIT-designed authentication protocol using a Key Distribution Centre, ticket-granting tickets and service tickets. The backbone of Active Directory authentication. Replay-protected via timestamps and a 5-minute clock skew tolerance.
- Origin
- MIT-designed authentication protocol
- Core components
- KDC, ticket-granting ticket, service tickets
- Primary use
- Active Directory authentication backbone
- Replay defence
- Timestamps with about 5-minute clock skew tolerance
Common questions
Why is Kerberos ticket theft significant in digital forensics investigations?+
Attack techniques such as Golden Ticket and Kerberoasting forge or crack ticket material to impersonate accounts without needing the plaintext password, so investigators look for anomalous ticket lifetimes, unusual service ticket requests, and KDC event log entries as evidence of compromise.
What breaks if the clock skew tolerance is exceeded between client and KDC?+
Kerberos authentication depends on timestamps to prevent replay attacks, so if a client and the Key Distribution Centre drift beyond the allowed skew, ticket requests are rejected even with correct credentials, which is a common cause of authentication failures worth ruling out during an incident review.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- IDS vs IPS
- An intrusion detection system observes copied traffic and alerts. An intrusion prevention system sits inline on the data path and blocks. Snort...
- IPSec AH and ESP
- Authentication Header provides integrity and origin authentication only. Encapsulating Security Payload provides confidentiality plus optional integrity. Almost all modern IPSec deployments use...
- NGFW
- Next-generation firewall: stateful packet inspection plus application identification, integrated IPS, TLS inspection and user-identity awareness. Palo Alto, Fortinet, Check Point and Cisco...
- Stateful Firewall
- A firewall that tracks the state of TCP connections in a connection table and permits return traffic of an established flow without...