案例库 · 软件与 IT · 技术决策 · 1988
这条还没译成中文，下面是英文原文。
MIT's Kerberos let a user authenticate once and get access everywhere
Kerberos used a ticket from a trusted server so a user proved identity once, without ever sending a password across the network.
Massachusetts Institute of Technology
那一手
MIT's Project Athena had to authenticate users across a campus network where passwords could be sniffed.
In 1988 Steve Miller and Clifford Neuman built Kerberos on the Needham–Schroeder protocol, using symmetric-key tickets instead of sending a password to each service.
Because one login produced service tickets for many systems, it became the first practical single sign-on, and MIT gave the implementation away.
为什么管用
- Symmetric-key tickets never exposed the long-term password to each service.
- A ticket-granting ticket meant one login yielded many access tokens, the core of single sign-on.
- Timestamps cut message rounds and made replay attacks much harder.
- MIT released it free and Windows Active Directory embedded it, so it scaled to hundreds of millions of machines.
可以搬走什么
When a network is untrusted, move the secret off the wire into a short-lived cryptographic ticket and let a trusted broker vouch for the user.
后来呢
Kerberos became the default authentication for Windows Active Directory and countless enterprise logins; version 5 is standardized in IETF RFC 4120.
资料来源
- Kerberos: The Network Authentication Protocol
- Port 56: XNS Authentication — The Ancestor of Kerberos
- RFC 4120: The Kerberos Network Authentication Service (V5)
发现哪里写错了？告诉我们。