Implementing-cryptography-using-python

40 Chapter 2 ■ Cryptographic Protocols and Perfect Secrecy
Alice creates an authenticator and sends it together with the Ticket Granting
Ticket and the name of the server to TGS:
A ➔ TGS: (S1, Ticket TGS , Authenticator A, TGS ) with Authenticator A, TGS = {A,
Addr A , t`A} KA, TGS
Once the TGS receives the message, it will decrypt Ticket TGS , extract the key
K A, TGS from the message, and use the key to decrypt Authenticator A, TGS . If the
name, ticket, and address of the authenticator matches, the TGS will ensure
the timestamp is still valid, check if Alice may access the service S1, and
create the following message:
TGS ➔ A: {K A, S1 }, S1, t TGS , LifetimeTicket S1 } KA, TGS with Ticket S1 = {K A, S1 , A,
Addr A , S1, t TGS , LifetimeTicket S1 } KTGS, S1
Alice decrypts the message and holds a session key for secure communication
between her and S1. She sends a message to S1 to show her ticket and a
new authenticator:
A➔ S1: (Ticket S1 , Authenticator A, S1 ) with Authenticator A,S1 = {A, Addr A , t``A} KA, S1
Once the ticket from Alice is received by Server 1, the server decrypts the
ticket with the key K TGS, S1 and shares with TGS the session key K A, S1 for secure
communication with A. Using the obtained key, the S1 checks the authenticator
and responds to A:
S1➔ A: {t``A + 1} KA, S1
Alice is able to verify that she is communicating with S1 and only S1 and the
TGS knows the key K TGS, S1 to decrypt Ticket S1 , which contains the session key
K A, S1 and so only S1 is able to decrypt Authenticator A, S1 and to answer with
t``A+1 encrypted with K A, S1 .
Multiple-Domain Kerberos
In many environments, an organization may be required to establish secure
communications with a service that is located inside another domain. If both
locations use their own Kerberos servers and user databases, then there are in
fact two different domains; in this context, we will refer to them as realms to
keep consistent with Kerberos terminology.
In an effort to avoid user duplication in both domains, Kerberos allows you
to perform an inter-realm authentication. Inter-realm authentication requires
that the Ticket Granting Servers of both domains share a secret key K TGS1, TGS2 .
The basic concept that is presented is that the TGS service of another realm
(domain) can be viewed as a normal server for which the TGS of the local realm
can hand out a ticket.