Kerberos Authentication Flow

Kerberos is a network authentication protocol designed to let users and services prove their identity securely over an insecure network. Instead of sending passwords around, Kerberos relies on encrypted tickets issued by trusted servers.

The process involves three main components:

• Authentication Server (AS)

• Ticket‑Granting Server (TGS)

• Service Server (SS)

1. Initial Authentication (Client → AS)

The client begins by contacting the Authentication Server to prove who they are. If the AS verifies the credentials, it issues a Ticket‑Granting Ticket (TGT). This TGT is encrypted and can only be understood by the TGS.

2. Requesting Access to a Service (Client → TGS)

When the client wants to access a specific service, it sends the TGT along with a request to the Ticket‑Granting Server. The TGS checks the TGT and, if valid, issues a service ticket for the requested service.

3. Accessing the Service (Client → Service Server)

Finally, the client presents the service ticket to the service server. If the ticket is valid, the server grants access. No passwords are exchanged at this stage—only encrypted tickets.

Kerberos ensures secure, mutual authentication and reduces the risk of credential theft by relying on short‑lived, encrypted tickets instead of reusable passwords.