Kerberos: The Definitive Guide

Cross-Realm (PKCROSS)

PKCROSS simplifies the management of cross-realm relationships between Kerberos realms. Traditional cross-realm relationships in Kerberos require the participating realms to share secret keys, which imposes the key management problems inherent in symmetric key cryptography. Namely, secret keys must somehow be securely transmitted to each of the participating Kerberos KDCs. PKCROSS uses public key cryptography to eliminate the need for KDCs to share secret keys and allows for more scalable Kerberos cross-realm relationships.

From a client’s perspective, communicating with two realms that use PKCROSS for cross-realm communication is exactly the same as communicating with two realms that use traditional Kerberos cross-realm shared keys. The operation of PKCROSS is entirely transparent to end users.

The PKCROSS extensions, instead, define a communication between the two KDCs involved in the cross-realm relationship. This is a major departure from traditional Kerberos protocols; no other Kerberos protocol exchange occurs between a KDC and another KDC. However, in this case, the direct KDC-to-KDC communication represents an elegant solution to public key cross-realm authentication. This way, Kerberos clients do not have to support public key encryption in order to communicate with realms that use PKCROSS for cross-realm authentication.

When a client requests a cross-realm TGT for two realms that support PKCROSS, the local KDC acts as a Kerberos client and requests ...