Breaking Kerberos

Page Content

Steve Lodin and Bryn Dole

Feb 23, 1996

Abstract

In the design of the Kerberos protocol, random session keys are generated and used as part of the authentication process. Kerberos uses the sessions keys as shared secrets between clients and sercers, and as the basis of establishing the authenticity of service requests. Kerberos also creates a random key to act as the Kerberos server's secret key. The security of the whole system depends on the secrecy of these keys. However, due to the way that Kerberos chooses its random keys, these secret keys can be easily guessed in a matter of seconds with no more information than which week the key was generated.
In the Security Seminar on Friday, Steve Lodin and Bryn Dole will show the WRTV Channel 6 Wednesday night lead story on the Kerberos vulnerability and discuss how they discovered the vulnerability and exploited it.



Unless otherwise noted, the security seminar is held on Wednesdays at 4:30P.M. STEW G52, West Lafayette Campus. More information...

© 1999-2013 Purdue University. All rights reserved.

Use/Reuse Guidelines

CERIAS Seminar materials are intended for educational, non-commercial use only and any or all commercial use is prohibited. Any use must attribute "The CERIAS Seminar at Purdue University." Opinions expressed in the recordings are not necessarily representative of the views of CERIAS or of Purdue University.