MIT's Kerberos let a user authenticate once and get access everywhere

MIT's Project Athena had to authenticate users across a campus network where passwords could be sniffed.

In 1988 Steve Miller and Clifford Neuman built Kerberos on the Needham–Schroeder protocol, using symmetric-key tickets instead of sending a password to each service.

Because one login produced service tickets for many systems, it became the first practical single sign-on, and MIT gave the implementation away.

A ticket from a trusted server, no password on the wire

Symmetric-key tickets never exposed the long-term password to each service.

A ticket-granting ticket meant one login yielded many access tokens, the core of single sign-on.

Timestamps cut message rounds and made replay attacks much harder.

MIT released it free and Windows Active Directory embedded it, so it scaled to hundreds of millions of machines.

When a network is untrusted, move the secret off the wire into a short-lived cryptographic ticket and let a trusted broker vouch for the user.

Kerberos became the default authentication for Windows Active Directory and countless enterprise logins; version 5 is standardized in IETF RFC 4120.