[7956] in Kerberos
Re: Confused on internet wide kerberos encryption
daemon@ATHENA.MIT.EDU (Richard Wackerbarth)
Sat Sep 14 08:01:18 1996
Date: Sat, 14 Sep 1996 06:17:16 -0500
To: Nick Kralevich <nickkral@ferrari.autobahn.org>
From: rkw@dataplex.net (Richard Wackerbarth)
Cc: kerberos@MIT.EDU
>I've been reading though the documentation for Kerberos, but there are
>still some things I don't understand.
>
>In the documentation, it says:
>
> Since Kerberos negotiates authenticated, and optionally encrypted,
> communications between any two points on the internet, it provides a
>How can I get an encrypted session from work to home, or visa versa. My
>understanding is that the kerberos program needs to be aware of any other
>kerberos tickets, and must know how to contact other key distribution
>centers.
Kerberos is primarily designed for authentication. If there is no scheme
for the two relms to know each other, there can be no authentication.
The encryption is more of a side effect in that the authentication scheme
provides a "shared secret" that is the basis of the key exchange.
If you need to communicate with encrypted, but unauthenticated
communications, you need something like DH which uses public key techniques
to build the common secret. However, realize that this only works to
provide security from certain kinds of attack. For example, MIM can still
breach the security.
