TCP/IP Tutorial and Technical Overview - IBM Redbooks

4. Now the user needs the authorization credentials, known as extended
privilege attribute certificate (EPAC), from the privilege service (PS).
Therefore, it must construct a privilege ticket granting ticket (PTGT) request
to retrieve this from the PS. To communicate with the PS, the client sends a
request to the AS to contact the PS. This request is encrypted with the
conversation key of the AS.
5. The AS receives this request. Using the secret key of the PS, the AS
generates a conversation key for the client to use when contacting the PS.
This is returned to the client and encrypted again with the AS conversation
key. The client receives the envelope and decrypts it (using the conversation
key) and discovers the conversation key for the PS. The client can now send
a privilege service ticket to the PS.
6. The PS receives the request and decrypts it with its secret key successfully.
This proves that the service ticket is legitimate, which also implies that the AS
involved is also legitimate. From this, the PS knows that the client and the AS
are valid. The PS constructs the EPAC, which lists the user's standard and
extended registry attributes, including group membership. The PS creates
more conversation keys and sends the EPAC and other information in an
encrypted PTGT envelope to the client.
7. The client decrypts the PTGT envelope using the PS conversation key. Also,
the client has the conversation key information and an encrypted PTGT
(which the client cannot decrypt, because it is encrypted using the AS secret
key).
8. Now, the client wants to contact an application server. To do so, it sends the
PTGT to the AS and requests a service ticket for the application server. The
AS receives the PTGT and decrypts it to obtain the EPAC information. It
encrypts the EPAC information with the secret key of the application server
and also provides a conversation key for the application server. This
information is encrypted with the conversation key of the AS (which the client
knows) and is returned to the client.
9. The client decrypts the envelope and discovers the application server's secret
conversation key. Using this key, it can now contact the application server. By
correctly decrypting the request from the client, the application server is able
to determine that the client has been authenticated, and by responding to the
client, the client knows that it was, indeed, the real application server that it
has contacted. The two will then establish a mutually authenticated session.
In addition to the extensive use of secret keys during the logon process,
third-party authentication makes use of time stamps to ensure that the
conversation is protected against intruders and eavesdropping. Time stamps
make impersonation techniques, such as record and playback, ineffective. Also,
the actual user password entered at logon time does not flow to the server as
such. Instead, it is used as an encryption key for the initial logon messages that
504 TCP/IP Tutorial and Technical Overview