TCP/IP Tutorial and Technical Overview - IBM Redbooks

22.11.1 Assumptions
22.11.2 Naming
Kerberos assumes the following:
► The environment using this security system includes public and private
workstations that can be located in areas with minimal physical security, a
campus network without link encryption that can be composed of dispersed
local networks connected by backbones or gateways, centrally operated
servers in locked rooms with moderate physical security, and centrally
operated servers with considerable physical security.
► Confidential data or high-risk operations such as a bank transaction cannot
be part of this environment without additional security, because after you
have a workstation as a terminal, you can emulate certain conditions and
normal data will be flowing without any encryption protection.
► One of the cryptosystems used is the Data Encryption Standard (DES), which
has been developed to be modular and replaceable by the Kerberos
designers.
► Kerberos assumes a loosely synchronized clock in the whole system, so the
workstation has to have a synchronization tool such as the time server
provided.
A principal identifier is the name that identifies a client or a service for the
Kerberos system.
In Version 4, the identifier consists of three components:
► The principal name is unique for each client and service assigned by the
Kerberos Manager.
► The instance name used for distinct authentication is an added label for
clients and services, which exist in several forms. For users, an instance can
provide different identifiers for different privileges. For services, an instance
usually specifies the host name of the machine that provides this service.
► The realm name used to allow independently administered Kerberos sites.
The principal name and the instance are qualified by the realm to which they
belong, and are unique only within that realm. The realm is commonly the
domain name.
In Version 4, each of the three components has a limit of 39 characters long. Due
to conventions, the period (.) is not an acceptable character.
In Version 5, the identifier consists of two parts only, the realm and the
remainder, which is a sequence of however many components are needed to
Chapter 22. TCP/IP security 865