It uses symmetric cryptography so a user can access multiple participating services without sending the user’s password to each service. Kerberos Version 5 is specified by the IETF.
The client first obtains a ticket-granting ticket from the KDC’s authentication service. It then presents that ticket to the ticket-granting service to obtain a service ticket for a particular service principal. The client presents the service ticket and fresh authenticator to the service, which may also prove its identity to the client. Tickets and session keys are held in a credential cache until expiry or removal.
Key points
Trust modelDefine realms, principals, service names, cross-realm relationships, KDCs, and long-term keys; a naming or key-management error can redirect or break authentication.
Ticket protectionUse current encryption types and pre-authentication, restrict ticket lifetime and delegation, protect keytabs and credential caches, and destroy tickets when no longer needed.
Operational dependencyMaintain accurate time, resilient KDC service, controlled key rotation, protected administration, and logs that can distinguish issuance from later service use.
Important limitationKerberos authenticates principals but does not decide what an authenticated principal may do. A compromised KDC, service key, endpoint, or ticket cache can enable broad impersonation or reuse until affected credentials expire or are replaced.