Protocols & PKIAcceptable
Kerberos cryptography
Ticket-based network authentication (symmetric keys)
How it works
Kerberos uses a trusted Key Distribution Center (KDC) and symmetric keys instead of sending passwords across the network. A user receives a Ticket-Granting Ticket (TGT), then service tickets encrypted with each service account's key. In Active Directory, the encryption type (etype) decides how strong that protection is.
Status: Use AES encryption types; disable RC4-HMAC and DES.
Strengths
- Passwords are never sent over the network
- Mutual authentication and single sign-on
- AES encryption types (RFC 3962) are strong
Weaknesses and known attacks
- Kerberoasting: service tickets encrypted with a service account's key can be cracked offline, which is easiest with RC4-HMAC and weak passwords.
- RC4-HMAC uses the account's NT hash as its key; RFC 8429 deprecates RC4 and 3DES in Kerberos.
- A stolen krbtgt key allows forged 'golden tickets'.
- Depends on synchronised clocks.
Use it for
- Enterprise authentication in Active Directory and other realms
Don't use it for
- RC4-HMAC or DES encryption types
- Service accounts with short, guessable passwords
Exam tip
Kerberos is symmetric-key authentication via a KDC and tickets, on port 88. Kerberoasting targets service accounts; long random service account passwords and AES etypes are the defence.