Kerberos
Ticket-based authenticationKerberos proves who you are without your password ever crossing the network. A central authority issues you a time-limited ticket once, when you log in, and that ticket buys further tickets for individual services — so every server can verify you without ever being told your secret.
Kerberos trades one login for a ticket, and that ticket for service tickets — the password itself never travels.
How it works
The service and the KDC never talk during this: the ticket is encrypted with the service’s own key, so being able to read it is proof enough. Timestamps inside are why every clock must be within five minutes.
What Kerberos does, step by step
The KDC returns a Ticket Granting Ticket encrypted so that only your password’s key can unlock it.
Presenting the TGT to the ticket granting service yields a ticket for one specific service.
The service decrypts the ticket with its own long-term key — no call back to the KDC needed.
The service can prove itself in return, and every ticket expires, typically within ten hours.
In cybersecurity
Kerberos is cryptographically sound and operationally sharp-edged — nearly every attack targets weak service passwords or a stolen ticket, not the protocol itself.
Any user can request a service ticket and crack it offline — service accounts need long random passwords.
A ticket lifted from memory is as good as the login; it needs no password at all.
Compromise the krbtgt key and an attacker mints valid TGTs for anyone, indefinitely.
Accounts with it disabled can be AS-REP roasted — a crackable reply for the asking.
Skew beyond five minutes breaks authentication outright; NTP is a dependency, not a nicety.
Unconstrained delegation lets a compromised server impersonate every user who touched it.