Back to the Roots of Single Sign-On: Kerberos
summary
Kerberos protocol internals: the AS/TGS/KDC/TGT ticket flow, session keys derived from passwords (string-to-key), and replay protection using timestamps that require clock sync (~5 minutes). Covers public-key pre-auth and smartcard options, keytab storage, Heimdal/MIT implementations and Microsoft Active Directory with SPNEGO for web, inspection of ASN.1 messages using OpenSSL and Wireshark over UDP/TCP, and a demonstrated efficiency gap (177 bytes vs 4622 bytes) plus remaining weaknesses like password brute-force and key distribution.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:11Distributed auth problem
- 10:00Needham-Schroeder solution
- 16:06Kerberos birth and adoption
- 20:45Kerberos operation
- 35:00ASN.1 message analysis
- 40:19Evolutions and security
- 44:09Kerberos vs modern SSO
related talks
55mKeep Your Secrets Secret - Kerberos in Java
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
50mWatching The Watchdog: Protecting Kerberos Authentication With Network Monitoring
31mAuthentication/Authorization Starters Battle
48mAdvanced Authentication and Encrypted Connections
40mThe Attacker’s Guide to SSO and Passwordless Technologies
40mExploiting Windows Hello for Business
01h 09mLife beyond FIPS 140-3: identity tales