Kerberos

From Citizendium
Revision as of 15:01, 11 November 2010 by imported>Howard C. Berkowitz
Jump to navigation Jump to search
This article is developing and not approved.
Main Article
Discussion
Related Articles  [?]
Bibliography  [?]
External Links  [?]
Citable Version  [?]
 
This editable Main Article is under development and subject to a disclaimer.

Kerberos is a networked authentication system developed at the Massachusetts Institute of Technology.[1], A central trusted "ticket-granting server" provides "tickets" which allow other machines to authenticate each other. Granting of specific rights, called credentialing, to authenticated machines can be by a separate secure server.

Specifications and documentation

The Kerberos protocol is specified in RFC 4120. There is an active working group at the IETF with many more documents. Microsoft's usage is documented in RFC 3244 and RFC 4757.

There is a FAQ. IBM provide a Kerberos primer.

Architecture

The separation of credentialing from authentication is not part of all authentication systems, but offers the ability to separate the administration of those two functions, which is a check-and-balance for personnel security of administators.

Vendor use

Kerberos has been used (not without controversy [1]) by all versions of Microsoft Windows since Windows 2000 [2]. It is also used by various Unix-based systems, including Sun, Apple, HP and IBM.

References