Appendix A. Kerberos 251
If the client requires mutual authentication (that is, the service has to prove its
identity to the client), the server could send back a message that is encrypted by
the session key it shares with the client, and application-dependent contents that
the client can verify. Because the service can only know the session key if it was
able to decrypt the service ticket, it must have known its secret key and so has
proven its identity.
Kerberos terminology
The following terms are used when discussing Kerberos authentication:
Realm A Kerberos domain that can consist of a number of
machines providing authentication services.
Principal A user or a service that uses authentication services and
is identified in the authentica ...