What is Kerberos?
Learn how Kerberos enables secure, passwordless authentication with ticket-based access and single sign-on, ensuring seamless & protected network communication.
What is Kerberos?#
Kerberos is a network authentication protocol developed at MIT in the 1980s to enhance secure communication over untrusted networks. It ensures secure user and service authentication without transmitting passwords directly, leveraging symmetric key cryptography and a trusted third party known as the Key Distribution Center (KDC).
Key Features of Kerberos#
- Passwordless Authentication: Employs strong, time-limited secret-key cryptography instead of relying on passwords.
- Single Sign-On (SSO): Users authenticate once to gain access to multiple services without repeated credential entries.
- Mutual Authentication: Verifies the identities of both users and servers, ensuring trusted communication.
- Ticket-based System: Uses encrypted, time-limited tickets containing user identity information for authentication.
How Kerberos Works#
- Initial Authentication: The client requests an authentication ticket (TGT) from the KDC's Authentication Server (AS).
- Ticket Granting: The KDC validates credentials and returns an encrypted TGT and session key.
- Service Access: The client uses the TGT to request a service ticket from the Ticket Granting Server (TGS).
- Service Authentication: The service ticket is presented to the server, granting access upon verification.
Advantages of Kerberos#
- Enhanced Security: Passwords are never transmitted over the network, reducing interception risks.
- Centralized Authentication: Provides a single point for managing logins and enforcing security policies.
- Scalability: Designed for large, distributed networks and integration with various operating systems.
Subscribe to our Passkeys Substack for the latest news.
Applications of Kerberos#
Kerberos is widely used in:
- Microsoft Windows Active Directory
- UNIX and Linux systems
- Single Sign-On (SSO) implementations
- Network service security, including SSH, POP, and SMTP protocols.
About Corbado
Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →
Share this article
Table of Contents
