Microsoft® Windows® 2000 Security Handbook

What Makes Kerberos Tick?

The Kerberos authentication protocol is made up of three subprotocols (or exchanges). The subprotocols are the Authentication Service (AS), the Ticket-Granting Service (TGS), and the Client/Server Exchange (CS).

The Authentication Service is the first subprotocol used when a user logs on to the network. This subprotocol gives the user a logon, a temporary encryption key (session key), and a TGT. Look at an example (see Figure 11.7):

Figure 11.7. The Authentication Service (AS) exchange.

1. Jim types his logon name and password to access the network.

2. The Kerberos client running on the client converts the password to an ...