Cyberstudy
PDF p.106 In progress

Single Sign-on Authorization

Open PDF at p.106 15 flashcards

Summary

PDF p.106

Single sign-on (SSO) authorization in Kerberos involves the client decrypting the Ticket Granting Service (TGS) session key and using it to request service tickets for accessing application servers. This process ensures mutual authentication between the client and the server, preventing on-path attacks.

In plain words

Supplementary — not from your PDF

With the TGT, the client asks the Ticket Granting Service for a service ticket for one application. The application checks the ticket and can prove its own identity back (mutual authentication). A second KDC avoids a single point of failure.

Detailed explanation

PDF p.106
  • Kerberos Authorization Process
    • Decrypting the TGS Session Key
      • Client Action: Decrypts the TGS session key but not the Ticket Granting Ticket (TGT), establishing shared knowledge with the KDC.
    • Requesting a Service Ticket
      • Principal Action: Sends the TGS a copy of the TGT, the name of the application server, and an authenticator (time-stamped client ID encrypted with the TGS session key).
      • TGS Action: Decrypts the messages using the KDC's secret key and the TGS session key, confirming the request's validity and checking for expiration or replay attacks.
    • TGS Response
      • Service Session Key: Encrypted with the TGS session key, used between the client and the application server.
      • Service Ticket: Contains principal information, encrypted with the application server's secret key.
  • Service Ticket Usage
    • Client Action: Forwards the service ticket and a time-stamped authenticator (encrypted with the service session key) to the application server.
    • Application Server Action: Decrypts the service ticket to obtain the service session key, confirming the message's authenticity, and decrypts the authenticator.
    • Optional Mutual Authentication: The server responds with the time stamp, encrypted with the service session key, which the client decrypts to verify the server's trustworthiness.
  • Drawbacks and Solutions
    • Single Point of Failure: The KDC is a single point of failure, but backup KDC servers can be implemented (e.g., multiple domain controllers in Active Directory).

Important terms

taken from the text above
Client Action
Decrypts the TGS session key but not the Ticket Granting Ticket (TGT), establishing shared knowledge with the KDC.
Principal Action
Sends the TGS a copy of the TGT, the name of the application server, and an authenticator (time-stamped client ID encrypted with the TGS session key).
TGS Action
Decrypts the messages using the KDC's secret key and the TGS session key, confirming the request's validity and checking for expiration or replay attacks.
Service Session Key
Encrypted with the TGS session key, used between the client and the application server.
Service Ticket
Contains principal information, encrypted with the application server's secret key.
Application Server Action
Decrypts the service ticket to obtain the service session key, confirming the message's authenticity, and decrypts the authenticator.
Optional Mutual Authentication
The server responds with the time stamp, encrypted with the service session key, which the client decrypts to verify the server's trustworthiness.
Single Point of Failure
The KDC is a single point of failure, but backup KDC servers can be implemented (e.g., multiple domain controllers in Active Directory).
SSO Single sign-on TGS Ticket Granting Service TGT Ticket Granting Ticket

Examples & real-world scenarios

Supplementary — not from your PDF
  • Requesting a service ticket for a file server.
  • The file server decrypting the ticket with its own secret key.
  • Multiple domain controllers acting as backup KDCs.

Scenario

The only domain controller goes offline and nobody can reach internal apps. Adding a second domain controller removes that single point of failure.

Common mistakes

Supplementary — not from your PDF
  • Confusing the TGT (for the TGS) with a service ticket (for one app server).
  • Assuming Kerberos needs no redundancy.

Practical skills

Supplementary — not from your PDF
  • Trace a Kerberos service ticket request.

What I should remember

Key Points PDF p.106
  • Kerberos Authorization Process
    • Decrypting TGS Session Key: Establishes shared knowledge with KDC.
    • Requesting Service Ticket: Sends TGT, server name, and authenticator to TGS.
    • TGS Response: Provides service session key and service ticket.
  • Service Ticket Usage
    • Client Action: Forwards service ticket and authenticator to server.
    • Server Action: Decrypts service ticket and authenticator.
    • Mutual Authentication: Optional server response with time stamp.
  • Drawbacks and Solutions
    • Single Point of Failure: KDC, mitigated by backup servers.