Countermeasure: Kerberos

Kerberos [STE88, KOH94] is a network authentication protocol designed to provide strong authentication for client/server applications by using secret key cryptography. Kerberos implements both authentication and access authorization by means of capabilities, called tickets, secured with symmetric cryptography. Microsoft has based much of its access control in its enterprise operating systems on Kerberos.

Kerberos requires two systems, called the authentication server (AS) and the ticket-granting server (TGS), which are both part of the key distribution center (KDC). A user presents an authenticating credential (such as a password) to the authentication server and receives a ticket showing that the user has passed authentication. Obviously, the ticket must prevent the user from modifying or forging one claiming to be a different user, and the ticket must prevent one user from acquiring another user’s ticket to impersonate that user.