The encyclopedia · Software & IT · Technical decision · 1988
MIT's Kerberos let a user authenticate once and get access everywhere
Kerberos used a ticket from a trusted server so a user proved identity once, without ever sending a password across the network.
Massachusetts Institute of Technology
the move
MIT's Project Athena had to authenticate users across a campus network where passwords could be sniffed.
In 1988 Steve Miller and Clifford Neuman built Kerberos on the Needham–Schroeder protocol, using symmetric-key tickets instead of sending a password to each service.
Because one login produced service tickets for many systems, it became the first practical single sign-on, and MIT gave the implementation away.
why it works
- Symmetric-key tickets never exposed the long-term password to each service.
- A ticket-granting ticket meant one login yielded many access tokens, the core of single sign-on.
- Timestamps cut message rounds and made replay attacks much harder.
- MIT released it free and Windows Active Directory embedded it, so it scaled to hundreds of millions of machines.
what transfers
When a network is untrusted, move the secret off the wire into a short-lived cryptographic ticket and let a trusted broker vouch for the user.
what came after
Kerberos became the default authentication for Windows Active Directory and countless enterprise logins; version 5 is standardized in IETF RFC 4120.
references
- Kerberos: The Network Authentication Protocol
- Port 56: XNS Authentication — The Ancestor of Kerberos
- RFC 4120: The Kerberos Network Authentication Service (V5)
spotted an error? The archive wants to know.