Taming Kerberos - Computerphile

Kerberos is an authentication method - Dr Mike Pound explains how it works so neatly.
EXTRA BITS: Kerberos Q&A • EXTRA BITS: Kerberos Q...
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com

[@jlxip]

I love how Mike Pound explains cryptography. He's my favorite guy of all Computerphile, next to Tom Scott, that is.

[@DrachenYT]

Well said. Both Dr. Pound and Tom are the absolute best in an already extremely high quality pot of speakers.

[@Gergely362]

not crypto, but obviously my third favourite guy is Professor Brailsford 😁

[@misterhat5823]

@@Gergely362 Brailsford is my favorite guy.

[@space_0027]

I agree!!

[@Daye04]

@@0megaSapphire did he say that in a Computerphile video, and not just in a Tom Scott video?

[@cyphern]

8:08 "My very well drawn curly brackets" -- damn right those are well drawn! That will make it extra secure.

[@JNCressey]

strange how it sounds like he's saying it sarcastically but they actually are well drawn.

[@cherrymountains72]

3:07 - “It’s an absolute mess”. Actually, it’s a full mesh! ... I will show myself out ...

[@lawrencedoliveiro9104]

The separation between the S and T servers is the separation between _authentication_ (proving you are who you say you are, done by S) and _authorization_ (what services you are allowed to access, controlled by T). Each one can be updated independently.

[@vbscrub]

In active directory though, neither of them seem to do authorization? Any user can get a ticket for any service. It's the service itself (file server etc) that determines if a user is allowed in, and that's completely independent of Kerberos. The Kerberos ticket just proves the user is who they claim to be

[@my0wn0p1n10n]

Thanks, I was confused why they were separated

[@nghiaminh7704]

I did reach the same observation, though I'm struggling to get the intuition behind this. Why did the inventor separate the 2 services? My first thought is that having a copy of all identification info in *each* server may increase the chance of it getting compromised. However, storing all passwords in one server also introduces a single point of failure, so my thought about the inventor's intuition could be wrong.

[@goonerw27]

VbScrub that is not true. In AD, Kerberos most certainly does authorisation. It’s the “Allowed to authenticate” right and if you don’t have that, the ticket is not produced, regardless of whether the resource would grant you access otherwise. If the account is “allowed to authenticate” and the ticket is produced, the resource can still perform its own authorisation. There’s more than one place where authorisation decisions are made.

[@vbscrub]

specifically: "I can confirm for a Windows Server 2016 deployment that “Allowed to Authenticate” has no effect on the KDC’s willingness to issue a TGS. I believe this is by design considering [MS-KILE] (3.3.5.7 TGS Exchange) states that the Allowed-to-Authenticate right is only checked if the TGT contains the OTHER_ORGANIZATION SID"

[@Blue-tz2pd]

"B is just sitting on the network waiting for people to talk to it" Same, B, same.

[@tonniesoms]

Acknowledged

[@longliveriley21]

Would love to see Dr. Mike Pound do a video on JSON Web Tokens!!

[@franky47]

I'd love to see his take on a comparison of the cryptography and advantages of JWTs and its alternatives (PASETO, Branca, Macaroons)

[@DanielLiNeutrinos]

Seconded!

[@DumitruValeriuVoicu]

That would be lovely

[@CocoBunnyXxX]

This is HANDS DOWN the BEST description of how Kerberos works. Straight forward, easy to understand. I feel like I truly understand it now, vs just having a general idea of what it does. Thanks so much for this great content!!❤❤❤

[@aprilmeowmeow]

I agree! this guy explains thing very well, and makes it all digestible.

[@user-jb4cn3jd3b]

We don’t deserve this guy fr

[@aaronwilliams7062]

12:48 I can just picture a lonely server spinning up disks that have been idle for years, like oh yea someone still wants me 😂

[@bharatirajanvss4937]

Hands-down the best explanation I've seen about kerberos auth mechanism on the internet.

[@NotATakenHandle846]

3:01 Kerberos and mike draws a pentagram lol

[@g4m3rl1k3]

The best and most in depth explanation of the Kerbaros protocol on KZbin. Thank you!

[@mattwalker2533]

I can't say this enough. I LOVE this channel and how well everything is explained! Dr. Pounds videos are my favorite as he's just so likable and amazing at his explanations. Keep up the amazing work everyone!

[@gplustree]

first heard of Kerberos nearly 30 years ago but never used it, this is the first time I've actually gotten a high-level overview that was super easy to understand - thank you!

[@jacobsteele2929]

Thank you so much Mike for these videos. I'm taking the security + right now and I would be lost without you. Your video's really help to solidify the text.

[@chbrules]

It was nice to see this overview again. I had to learn to setup a KDC and do all this ticketing stuff for my RHCE certification. It was good to know, so I have a better understanding of what's going on behind the scenes.

[@stephenm3874]

This is a decent retro perspective on hard coding server based authority networking. Thank you for your efforts. Back in the early nineties we used this with Norvell for user based authentication for both bridges and simple internal routing via IPX. Cool to see it being reimplimated for wide distribution systems. Our biggest concern back then was Chatterbox, inbound exchanges outside of our secured internal networks with disparate network protocols. IP was not a standard like today.

[@hankcohen3419]

Thank you. This was a great description of Kerberos. I wish I had had it many years ago when I read the original paper.

[@hnasr]

What an elegant design! And well explained Professor!

[@WouterWeggelaar]

This is a brilliant explanation! I've been working with KRB (MIT and Heimdal) and OpenAFS for a decade, but recently moved to (samba) AD. Kerberos is my friend! The most common failure of both is clock offsets! If the lifetime doesn't match or the timestamp is in the future, it throws funnies. never had any serious issues in those 10 years. KDCs just keep on working

[@marcoandreabrambillasca9003]

Such a beautiful topic. Amazingly explained!

[@helshabini]

It is worth mentioning that in AD, the authorization is split between the ticket granting service and the target resource (in this case the file server). The ticket will also carry information about group membership, which will allow the file server to determine whether the user trying to access it is allowed, or is a member of a group that is allowed to access the server. Also worth mentioning that because of all these timestamps floating around, it is imperative that all these systems have the same time.

[@LegendBegins]

Really good Kerberos overview! Nice job.

[@Denverse]

I've been waiting for the video!

[@pierrebertin4364]

So clear and helpful, thank you Mike once again.

[@spacebar420]

Woo, finally something I'm close to understanding and actually has something to do with my work.

[@mahmoudkanaan3653]

brilliant mechanism and brilliant explaination , thank you.

[@mateenkiani6858]

Your videos are the reason why I'm subscribed to this channel

[@thomastang2587]

I am so glad I can watch videos made by geniuses. And I admire your modesty as well.

[@space_0027]

I like Mikes videos! Keep it up Computerphile!

[@br3achbr3aker]

A wonderful video on how Kerberos works!

[@Organic_Fables14]

This video helped in me in understanding kerberos in expert level...thanks for the very clear explanation i was able to finish my assignment because of this

[@markstanley7251]

Got to say your excellent in the way you explain, not that you need it but a big thumbs up from me . 👍🏻

[@citimatters8473]

For those wondering why the timestamp T is necessary throughout most of the video, wait until near the end where Mike explains that it's a way to defend against an imposter. It's perfectly understandable why this was discussed only near the end (13:53). Be patient, it's explained in the video.

[@BorjaTarraso]

Your best video Mike.

[@sp10sn]

Dr. Pound at home? Checks out. That is almost certainly the home decor of a computer scientist ;)

[@ducky1086]

Nice quality "at home" video! Quite a rarity at the moment!

[@N0DIS]

Dr Mike ... please do a similar video for SAML [2.0] and federated identity management! You make everything so clear.

[@vbscrub]

Great explanation as always. I've also made a few videos about kerberos myself recently, mainly demonstrating some of the ways to circumvent the security of it. Oh and one small correction: in active directory its not the authentication server or KDC that decides if the user is allowed to access the service its requesting a ticket for - its up to the service on the file server etc to decide if the user is allowed in or not. All the KDC does is "guarantee" that the user is who they say they are. So yeah any user can request a ticket for any service that supports kerberos auth, which is a bit of a security issue because now anyone can get hold of some data that was encrypted using the password of the user account running that service, and they can then brute force that offline to get the password.

[@lawrencedoliveiro9104]

In other words, Active Directory is less secure than true Kerberos?

[@vbscrub]

@@lawrencedoliveiro9104 sounds like it, but its the only version of Kerberos I've ever worked with so hard to say. Regardless, its the most commonly used version of kerberos in the world so its probably worth focusing on that when talking about security

[@tigerfish66]

brilliantly explained, thank you

[@HiAdrian]

Really well explained, thanks!

[@skizz_]

Great video, so well put and easy to understand. I imagine this is how Jared would look if he had decided to go down the tech road and not biz dev.

[@Am6-9]

One day, after doing a lot of reading and research, I nearly completely understood Kerberos. The next day, I’ve already forgotten most of it again...

[@JNCressey]

this sounds like it could be a temporary key joke.

[@KnakuanaRka]

JNCressey Yeah, I thought that too.

[@F3f33f]

Amazing teacher. Thank you!

[@c3realpt]

Thanks Dr Mike!!!

[@nader1999ful]

Great video, love the intuitive examples! just a quick note, Kerberos doesn't require a password for every client, it does however require a shared key with the KDC as you explained. and in various cases the client doesn't have an actual password, they just have a a shared secret (active directory magic), virtual machines in the cloud for example. and if a third party sends the KDC a request in a valid client's name, the KDC will answer anyway because it doesn't matter, since only the actual user can decrypt and use the answer of the KDC correct me if I'm mistaken, and Thanks for the great video! :)

[@damiani888]

Thank you, this is a great explanation! Can you do a Part 2 for this video explaining a 2-hop scenario? For example an AD user on their laptop requests data from server A, which then impersonates the AD user to request data from server B? I think many of my colleagues would watch it too.

[@Semtx552]

you forget that's its a remote interview, well done! also i love a vid on my field of expertise and still has some new details for me, which causes me to tinker with AD a bit more. thanks! :)

[@BastiDood]

This pattern vaguely looks like the Authorization Code Flow for OAuth 2.0. Pretty neat! 👍

[@Markd315]

Really the only functional differences I can see is that: Oauth2 has some extra hoops it jumps through to allow user consent inputs Kerberos has some extra hoops it jumps through to avoid asymmetric crypto The TGS acts as a token refresher

[@LimitedWard]

I had to implement Kerberos SSO support for the software that my company makes. I had no idea what all the settings did, but now it all makes sense.

[@watcher314159]

PSA: Kerberos means "Spotted One". Even millennia ago the tradition of naming your dog Spot was so strong that even the gods got in on it.

[@lawrencedoliveiro9104]

And “Fido” (faithful one) I think was a Latin tradition.

[@squirlmy]

@@lawrencedoliveiro9104 A lot of Romans also called their dogs "Nero" as an insult to the late emperor. The subject of dog names is going down a "rabbit hale"

[@frankschneider6156]

We all know that the only proper name for a dog is "Dogmeat".

[@the_hanged_clown]

is the original actually pronounced "kerberos"? I've only ever seen it spelt "cerberos" and pronounced "serb" lol have I been wrong for 30 years?

[@watcher314159]

@@the_hanged_clown Language evolution is a doozy. In ancient Greek it was kerberos, and in modern Greek it still mostly still is though the k and b have softened, but Latin had a bunch of weird sound changes that English inherited and continued that mutated the k and all the vowels.

[@Divv]

As someone else commented I would like to see a video on JSON Web Tokens. An extra plus would be if it also explained the whole refresh token mechanism which I think is much of the reason for why we are always logged in on different web services like Facebook, KZbin, etc.

[@gizmo95]

Really great video, helped a lot.

[@chrischrysafis90]

this guy is amazing at explaining

[@alexandracimpeanu4310]

Amazing video! Thank you!!

[@anonymousvevo8697]

this guy is just amazing ! great explanation =)

[@premkulkarni8012]

Mike you should be a Professor at MIT or Harvard ! You are the best !

[@WelteamOfficial]

Nice video Maybe you could do a future video on Plan9 authentification mecanism/factotum and it's advantages over Kerberos :D

[@rich1051414]

Where is alice, bob, charlie, and debbie these days, anyway? I heard all about their problems in school for computer science.

[@Androidonator]

They have to maintain social distancing.

[@coronapapi]

They're visiting our Dear Aunt Sally, of course!

[@KnakuanaRka]

I usually hear the latter two as Carol and David.

[@theorderoforange]

Awesome! Could you do one on SAML as well?

[@ahmedaj2000]

Well explained thanks!

[@RicardoRebelo99]

2:57 - TFW Trying to explain computer stuff but you're actually summoning the devil. Jokes aside, thank you very much for this video. I have learned a lot from this channel in the preparation for my CISSP exam. These videos explain really things that the "official" books really don't (from my perspective).

[@kakarotz9296]

I remember studying Kerberos and thinking I'd never understand this. Also was amazed how almost all Windows / AD / Exchange engineers I've met has not retained this knowledge!

[@vbscrub]

Most windows admins never know anything about Kerberos... because they don't need to. It just works. I was a windows admin for 9 years in many different organisations and not once did me or my colleagues ever need to know anything about Kerberos. It all gets handled by windows automatically and doesn't require any maintenance for the most part

[@santoshr4212]

Excellent!

[@dopeboypirat3102]

I've rescued several townsfolk isolated in their homes by purging that three headed beast from their cache located in their home directory after which they were again, able to go to town and conduct business. On a different note, can you guys please talk about principle component analysis using a compressed representation or subspace neural physics. I want to hear more about it from you guys :)

[@gigipigi7043]

great video! thank you!

[@Scalli82]

Great video. Just wondering, in an Active Directory scenario does the encryption process utilize the TLS cipher suites available on the servers? Which is to say Kerberos has a dependency on the TLS protocol level and ciphers suites available on the host and server? Or does the Kerberos mechanism have it's own encryption protocol that is consistent across all Windows OS levels?

[@TheN9nth]

I believe every endpoint will need to utilise it's own encryption at some point when sending securely to the KDC. The host/server and Kerberos agree upon an encryption algorithm when initially establishing their long-term symmetric key.

[@Knowledge_is_Power911]

the sounds of that market freaks me out ! but great content sir !

[@mirceagheoace549]

Wonderful video! I don't get how the long term key Kas is shared between the Kerberos server and computer A.

[@SaiMako19]

Beautiful, now I know how ActiveRecord works!

[@yon2004]

An interesting thing that should be mentioned is that the that KaT key contains you list of group memberships so when accessing the file server it can do authorisation without contacting the domain controller.

[@dekeonus]

only in AD, groups (and for that matter system users) aren't part of the kerberos protocol

[@KnakuanaRka]

Speaking of Kat, A had to go through S to get that, so how does B know Kbt when A sends it a message encrypted with that?

[@MyAce8]

Could you guys do a video on prime order elliptic curves and their applications in commitment schemes, and zero knowledge proofs?

[@enkaperson]

every time I develop a solution and find myself having to deal with Kerberos, I look the other way because it's so scary.

[@whuzzzup]

What encryption does it use and did this change over the decades? How is the very first key exchanged? Any protocol (that changed over decades?) or just whatever people wanted to use (floppy, pen&paper, ... DH)?

[@marusak72]

When I saw him using a tabulation paper with those green lines I subscribed immediately 😊

[@TheNewAccount2008]

There is one thing I don't get: Why does B have a long term key with T (Kbt) while A does not? Doesn't B have to go through the TGT process as well?

[@gralha_]

I think that was a mistake, and it's actually supposed to be a session key. But maybe it could be because B is a server and so presumably always on

[@belst_]

take a shot everytime he says ticket

[@outrageouspickles7152]

The ticket granting ticket is going to kill me

[@the_terrorizer]

Joshua Rombauer help

[@dl8590]

Every time he sneaks in an ‘alright’

[@AsmodeusMictian]

@@dl8590 That's actually the lethal one I'd wager :D

[@lawrencedoliveiro9104]

8:30 And you can also verify n[a], to guard against fraudulent responses.

[@8Dbaybled8D]

No offence Sean, this is the best I've seen Mike lit and at this point, I've seen most of his videos with him, from pneumonia pale to pneumonia yellow.

[@Computerphile]

Fair comment, we'll have to get a dining room window installed in the other end of Mike's office :)

[@TehDunsparce]

Just want to make sure I'm understanding the bit at 13:50 correctly. So B sends back Ta+1 to A to prove that it was able to read the message (A,Ta) using Kab that it received?

[@cheaterman49]

I was a bit worried at the beginning that the nonce isn't encrypted in the ticket request, but AIUI since you don't have Kas it doesn't matter, you can't decrypt Kat and get authorization to other services?

[@corriedotdev]

a week and a half into kerberos delegation bug, prayers appreciated

[@no_power]

What is inside that terrarium behind you my dude?

[@Abby_Liu]

a three-headed dog

[@bronsonschnitzel7493]

The classic sleeve adjustment lives on in the remote world

[@DumblyDorr]

I once had to do some Service Principal configuration & administration with Kerberos in AD. That was >10 years ago. I still have nightmares.

[@goininXIV]

One thing I don't understand, why does K_at need to be generated but K_bt is long-term? Or would K_at only and immediately be generated when A joins the system and K_bt missing would imply B not being present?

[@praphullachandra5893]

Very nice explanation, but I had a couple questions if anybody could answer: 1) Why does the authentication and Ticket granting need to be done by two separate servers? Can't they be combined in a single server that authenticates and directly gives the ticket Kab? Why the additional hop to the ticket granting server (even if authentication and ticket granting services are on the same server, I am guessing this hop to the ticket granting service occurs)? This doesn't appear to be a massively expensive operation that the two services need to be separated. 2) How is the initial 'long term password' between the servers/computers exchanged? Surely that is the problem that public key encryption is needed to solve. Once both sides have a shared secret, symmetric key works just fine, but this video doesn't address how that initial password between the servers (or to the user) is exchanged securely. Thanks!

[@enochliu8316]

1) The idea is that the authentication and Ticket granting server can be updated independently. Without that, you would have to make the protocol complicated for different cases. 2)The long-term key is shared out of band. We don't care how the long-term key gets there.

[@kennys1881]

Someone who knows, correct me if i'm wrong; So basically, per-user unique keys are stored in a central server (created when they first sign up), and this key generates more keys when user wants to talk to peripherals connected to the server. (peripherals as other users etc) If this is correct, my follow up question is, while the user is signing up the first time, how is his 'password' sent over? Public Key system? Then quantum cracking over first step will get the password & decrypt all the tickets the server produces later on.

[@DDvargas123]

I was thinking the same question ;o;

[@Lttlemoi]

I'd assume some side channel is used to set up an initial password or in a controlled environment, all users might start out with a default password that they are required to change immediately after the first authentication.

[@keithd7904]

The initial password has to be setup on the authentication server when the user gets created. For example with Active Directory an account cannot be enabled until a password is assigned to it first.

[@setudesai]

AFAIK in the active directory and kerberos systems you don't sign up per se. An admin user registers a new account and gets given a temporary password which is to be changed upon first login. This way even on first authentication the password is already there which is used tp encrypt the communication.

[@Don-Carillo]

So the KDC doesn't actually hold the user’s password, just a set of keys derived from the principles password. Is that right?

[@younesrabhi5298]

wunderbar !!

[@Beni10PT]

And when you register to create your account, what kind of encryption does it use? Because the creation of the account seems to be quite important as well

[@drdca8263]

I’m guessing this is an “out of band” thing. Either that or someone who already has an account connects to the server to create your account? My experience at work is that when they create your account, they assign a temporary password which you use to log in, and then you change your password.

[@zeroedsalvo1657]

would be very nice if you put all those crypto/network videos into a playlist (sorry if you already did, just couldn't see it)

[@phy2sll]

Have I understood correctly: B has a long term ticket from T, but A does not. Why is that? Are they exchanged without involvement from S?

[@eddievhfan1984]

Presumably, B has already been preloaded with the K_bt key upon installation/configuration, and does not need to talk to S. Otherwise, it did the same dual-step authentication A did ages ago, but as a trusted server, it was granted a longer-term ticket than client connections would be.

[@lawrencedoliveiro9104]

@@eddievhfan1984 The server doesn’t need any tickets; only the client does.

[@KnakuanaRka]

Kyle Tekaucic But if B can get a long-term key with T, why does A need to go through S to get it?

[@lawrencedoliveiro9104]

A never gets that key. It only gets tickets encrypted with that key.

[@mboby2000]

Well done boss. Just a small question, if you don't mid. How can the server b validate the message comes from server a without contacting the server S?

[@nollakayttaja2842]

is the ticket server AD-DC, or what that "ticket server" requires to function?

[@mikechappell4156]

I like your content, but is there a possibility of doing something about your echo?

[@Checker8763]

Just one question to fully understand this: How do encrypt a shared secret like K at symmetric and share it with T so T can decrypt the shared secret? Or is there no need to do this?

[@li5up6]

The shared secret is encrypted by the Ks,t a long term key that S and T use to communicate. It sends you it aka the ticket granting ticket which you send to T to begin talking to it

[@utkarshanand9706]

In general we look for decentralised peer to peer networks, because that ticket granting server is a central point of failure and cannot always be trusted and there a high chance of it being compromised. The industry is moving towards permissionless systems, because not even the central authority granting permission can be considered reliable when it comes to rights, as in the central authority might have a bias.

[@jpcf3022]

Question: Does B have a permanent Ktb key, or how did it get hold of it??

[@TheN9nth]

B has to authenticate through S to create a key with T at some point, just like any other device. Difference is that the key it generates will last a lot longer usual before needing to be renewed again.

[@mandy1339]

Excellent4!

[@esra_erimez]

How do you get SAML to work with Kerberos?

[@hudatolah]

@5:50 Why use S for Authentication service and T for Ticket Service? I had to watch that twice because that acronym mix up got me. I wish you had drawn A for Authentication.