I love how Mike Pound explains cryptography. He's my favorite guy of all Computerphile, next to Tom Scott, that is.

@DrachenYT

4 жыл бұрын

Well said. Both Dr. Pound and Tom are the absolute best in an already extremely high quality pot of speakers.

@Gergely362

4 жыл бұрын

not crypto, but obviously my third favourite guy is Professor Brailsford 😁

@misterhat5823

4 жыл бұрын

@@Gergely362 Brailsford is my favorite guy.

@space_0027

4 жыл бұрын

I agree!!

@Daye04

4 жыл бұрын

@@0megaSapphire did he say that in a Computerphile video, and not just in a Tom Scott video?

3:07 - “It’s an absolute mess”. Actually, it’s a full mesh! ... I will show myself out ...

8:08 "My very well drawn curly brackets" -- damn right those are well drawn! That will make it extra secure.

@JNCressey

4 жыл бұрын

strange how it sounds like he's saying it sarcastically but they actually are well drawn.

The separation between the S and T servers is the separation between _authentication_ (proving you are who you say you are, done by S) and _authorization_ (what services you are allowed to access, controlled by T). Each one can be updated independently.

@vbscrub

4 жыл бұрын

In active directory though, neither of them seem to do authorization? Any user can get a ticket for any service. It's the service itself (file server etc) that determines if a user is allowed in, and that's completely independent of Kerberos. The Kerberos ticket just proves the user is who they claim to be

@my0wn0p1n10n

4 жыл бұрын

Thanks, I was confused why they were separated

@nghiaminh7704

4 жыл бұрын

I did reach the same observation, though I'm struggling to get the intuition behind this. Why did the inventor separate the 2 services? My first thought is that having a copy of all identification info in *each* server may increase the chance of it getting compromised. However, storing all passwords in one server also introduces a single point of failure, so my thought about the inventor's intuition could be wrong.

@goonerw27

4 жыл бұрын

VbScrub that is not true. In AD, Kerberos most certainly does authorisation. It’s the “Allowed to authenticate” right and if you don’t have that, the ticket is not produced, regardless of whether the resource would grant you access otherwise. If the account is “allowed to authenticate” and the ticket is produced, the resource can still perform its own authorisation. There’s more than one place where authorisation decisions are made.

@vbscrub

4 жыл бұрын

specifically: "I can confirm for a Windows Server 2016 deployment that “Allowed to Authenticate” has no effect on the KDC’s willingness to issue a TGS. I believe this is by design considering [MS-KILE] (3.3.5.7 TGS Exchange) states that the Allowed-to-Authenticate right is only checked if the TGT contains the OTHER_ORGANIZATION SID"

"B is just sitting on the network waiting for people to talk to it" Same, B, same.

@tonniesoms

2 жыл бұрын

Acknowledged

Would love to see Dr. Mike Pound do a video on JSON Web Tokens!!

@franky47

4 жыл бұрын

I'd love to see his take on a comparison of the cryptography and advantages of JWTs and its alternatives (PASETO, Branca, Macaroons)

@DanielLiNeutrinos

4 жыл бұрын

Seconded!

@DumitruValeriuVoicu

4 жыл бұрын

That would be lovely

This is HANDS DOWN the BEST description of how Kerberos works. Straight forward, easy to understand. I feel like I truly understand it now, vs just having a general idea of what it does. Thanks so much for this great content!!❤❤❤

@aprilmeowmeow

8 ай бұрын

I agree! this guy explains thing very well, and makes it all digestible.

@user-jb4cn3jd3b

6 ай бұрын

We don’t deserve this guy fr

12:48 I can just picture a lonely server spinning up disks that have been idle for years, like oh yea someone still wants me 😂

Hands-down the best explanation I've seen about kerberos auth mechanism on the internet.

This is a brilliant explanation! I've been working with KRB (MIT and Heimdal) and OpenAFS for a decade, but recently moved to (samba) AD. Kerberos is my friend! The most common failure of both is clock offsets! If the lifetime doesn't match or the timestamp is in the future, it throws funnies. never had any serious issues in those 10 years. KDCs just keep on working

I can't say this enough. I LOVE this channel and how well everything is explained! Dr. Pounds videos are my favorite as he's just so likable and amazing at his explanations. Keep up the amazing work everyone!

3:01 Kerberos and mike draws a pentagram lol

It is worth mentioning that in AD, the authorization is split between the ticket granting service and the target resource (in this case the file server). The ticket will also carry information about group membership, which will allow the file server to determine whether the user trying to access it is allowed, or is a member of a group that is allowed to access the server. Also worth mentioning that because of all these timestamps floating around, it is imperative that all these systems have the same time.

first heard of Kerberos nearly 30 years ago but never used it, this is the first time I've actually gotten a high-level overview that was super easy to understand - thank you!

The best and most in depth explanation of the Kerbaros protocol on KZread. Thank you!

This is a decent retro perspective on hard coding server based authority networking. Thank you for your efforts. Back in the early nineties we used this with Norvell for user based authentication for both bridges and simple internal routing via IPX. Cool to see it being reimplimated for wide distribution systems. Our biggest concern back then was Chatterbox, inbound exchanges outside of our secured internal networks with disparate network protocols. IP was not a standard like today.

One day, after doing a lot of reading and research, I nearly completely understood Kerberos. The next day, I’ve already forgotten most of it again...

@JNCressey

4 жыл бұрын

this sounds like it could be a temporary key joke.

@KnakuanaRka

4 жыл бұрын

JNCressey Yeah, I thought that too.

Where is alice, bob, charlie, and debbie these days, anyway? I heard all about their problems in school for computer science.

@Androidonator

4 жыл бұрын

They have to maintain social distancing.

@coronapapi

4 жыл бұрын

They're visiting our Dear Aunt Sally, of course!

@KnakuanaRka

4 жыл бұрын

I usually hear the latter two as Carol and David.

Woo, finally something I'm close to understanding and actually has something to do with my work.

It was nice to see this overview again. I had to learn to setup a KDC and do all this ticketing stuff for my RHCE certification. It was good to know, so I have a better understanding of what's going on behind the scenes.

Thank you so much Mike for these videos. I'm taking the security + right now and I would be lost without you. Your video's really help to solidify the text.

Dr Mike ... please do a similar video for SAML [2.0] and federated identity management! You make everything so clear.

Thank you. This was a great description of Kerberos. I wish I had had it many years ago when I read the original paper.

What an elegant design! And well explained Professor!

Such a beautiful topic. Amazingly explained!

Really good Kerberos overview! Nice job.

PSA: Kerberos means "Spotted One". Even millennia ago the tradition of naming your dog Spot was so strong that even the gods got in on it.

@lawrencedoliveiro9104

4 жыл бұрын

And “Fido” (faithful one) I think was a Latin tradition.

@squirlmy

4 жыл бұрын

@@lawrencedoliveiro9104 A lot of Romans also called their dogs "Nero" as an insult to the late emperor. The subject of dog names is going down a "rabbit hale"

@frankschneider6156

4 жыл бұрын

We all know that the only proper name for a dog is "Dogmeat".

@the_hanged_clown

4 жыл бұрын

is the original actually pronounced "kerberos"? I've only ever seen it spelt "cerberos" and pronounced "serb" lol have I been wrong for 30 years?

@watcher314159

4 жыл бұрын

@@the_hanged_clown Language evolution is a doozy. In ancient Greek it was kerberos, and in modern Greek it still mostly still is though the k and b have softened, but Latin had a bunch of weird sound changes that English inherited and continued that mutated the k and all the vowels.

There is one thing I don't get: Why does B have a long term key with T (Kbt) while A does not? Doesn't B have to go through the TGT process as well?

@gralha_

4 жыл бұрын

I think that was a mistake, and it's actually supposed to be a session key. But maybe it could be because B is a server and so presumably always on

I've been waiting for the video!

brilliant mechanism and brilliant explaination , thank you.

So clear and helpful, thank you Mike once again.

Dr. Pound at home? Checks out. That is almost certainly the home decor of a computer scientist ;)

A wonderful video on how Kerberos works!

Your videos are the reason why I'm subscribed to this channel

I am so glad I can watch videos made by geniuses. And I admire your modesty as well.

One thing I don't understand, why does K_at need to be generated but K_bt is long-term? Or would K_at only and immediately be generated when A joins the system and K_bt missing would imply B not being present?

Great video, love the intuitive examples! just a quick note, Kerberos doesn't require a password for every client, it does however require a shared key with the KDC as you explained. and in various cases the client doesn't have an actual password, they just have a a shared secret (active directory magic), virtual machines in the cloud for example. and if a third party sends the KDC a request in a valid client's name, the KDC will answer anyway because it doesn't matter, since only the actual user can decrypt and use the answer of the KDC correct me if I'm mistaken, and Thanks for the great video! :)

For those wondering why the timestamp T is necessary throughout most of the video, wait until near the end where Mike explains that it's a way to defend against an imposter. It's perfectly understandable why this was discussed only near the end (13:53). Be patient, it's explained in the video.

I like Mikes videos! Keep it up Computerphile!

This video helped in me in understanding kerberos in expert level...thanks for the very clear explanation i was able to finish my assignment because of this

I had to implement Kerberos SSO support for the software that my company makes. I had no idea what all the settings did, but now it all makes sense.

Great explanation as always. I've also made a few videos about kerberos myself recently, mainly demonstrating some of the ways to circumvent the security of it. Oh and one small correction: in active directory its not the authentication server or KDC that decides if the user is allowed to access the service its requesting a ticket for - its up to the service on the file server etc to decide if the user is allowed in or not. All the KDC does is "guarantee" that the user is who they say they are. So yeah any user can request a ticket for any service that supports kerberos auth, which is a bit of a security issue because now anyone can get hold of some data that was encrypted using the password of the user account running that service, and they can then brute force that offline to get the password.

@lawrencedoliveiro9104

4 жыл бұрын

In other words, Active Directory is less secure than true Kerberos?

@vbscrub

4 жыл бұрын

@@lawrencedoliveiro9104 sounds like it, but its the only version of Kerberos I've ever worked with so hard to say. Regardless, its the most commonly used version of kerberos in the world so its probably worth focusing on that when talking about security

Got to say your excellent in the way you explain, not that you need it but a big thumbs up from me . 👍🏻

Just want to make sure I'm understanding the bit at 13:50 correctly. So B sends back Ta+1 to A to prove that it was able to read the message (A,Ta) using Kab that it received?

Hi, I'm a bit confused about A B and T and have 2 questions. From the video, A received a short-term K_at from S in order to talk to T. Later, T send A a key K_ab encrypted in K_bt. 1. The K_bt was said to be long-term. It is supposed to be short-term, right? 2. Similar to K_at being granted from S, K_bt should have been granted from S at an earlier time when B authenticated with S, right? Or is it some other time?

What encryption does it use and did this change over the decades? How is the very first key exchanged? Any protocol (that changed over decades?) or just whatever people wanted to use (floppy, pen&paper, ... DH)?

Your best video Mike.

Well done boss. Just a small question, if you don't mid. How can the server b validate the message comes from server a without contacting the server S?

Amazing teacher. Thank you!

Nice quality "at home" video! Quite a rarity at the moment!

This pattern vaguely looks like the Authorization Code Flow for OAuth 2.0. Pretty neat! 👍

@Markd315

4 жыл бұрын

Really the only functional differences I can see is that: Oauth2 has some extra hoops it jumps through to allow user consent inputs Kerberos has some extra hoops it jumps through to avoid asymmetric crypto The TGS acts as a token refresher

Great video, so well put and easy to understand. I imagine this is how Jared would look if he had decided to go down the tech road and not biz dev.

Really well explained, thanks!

take a shot everytime he says ticket

@outrageouspickles7152

4 жыл бұрын

The ticket granting ticket is going to kill me

@the_terrorizer

4 жыл бұрын

Joshua Rombauer help

@dl8590

4 жыл бұрын

Every time he sneaks in an ‘alright’

@AsmodeusMictian

3 жыл бұрын

@@dl8590 That's actually the lethal one I'd wager :D

I was a bit worried at the beginning that the nonce isn't encrypted in the ticket request, but AIUI since you don't have Kas it doesn't matter, you can't decrypt Kat and get authorization to other services?

every time I develop a solution and find myself having to deal with Kerberos, I look the other way because it's so scary.

How does S know the symmetric key of A to authenticate or in the first place? I know it's password based but how is the password synced between A and S securely?

How is the communication between a and s secure against mitm attacks?

Interesting, but there is one thing that makes no sense: at 12:18, the message that tells B what Kab is is encrypted with Kbt, which you say only T and B know. The problem is that B should not have Kbt, since only the S keys are long term, and A had to go through S to get Kat. Why does B know Kbt already? And if Kbt is another long term key like the S key, why is Kat not long term?

@MrOgrable

4 жыл бұрын

Two possibilities here: either Kbt is automatically genereated when B connect to the network and regularly updated, or Kbt is generated at the initiative of T whenever someone request access to B. I'm not a Kerberos expert so I don't know the correct answer but this bugged me too...

@christianbarnay2499

4 жыл бұрын

A and B don't have identical roles. B has previously registered as a Service Provider through a different process, usually involving at least some kind of manual approval by a network administrator.

@KnakuanaRka

4 жыл бұрын

Christian Barnay Sure, I guess it makes sense that B is treated differently than A, but they should have been more specific about it.

is the ticket server AD-DC, or what that "ticket server" requires to function?

brilliantly explained, thank you

Thanks Dr Mike!!!

Wonderful video! I don't get how the long term key Kas is shared between the Kerberos server and computer A.

How is the very first request from A to S encrypted? I.e. how is the long term key negotiated/shared?

Thank you, this is a great explanation! Can you do a Part 2 for this video explaining a 2-hop scenario? For example an AD user on their laptop requests data from server A, which then impersonates the AD user to request data from server B? I think many of my colleagues would watch it too.

As someone else commented I would like to see a video on JSON Web Tokens. An extra plus would be if it also explained the whole refresh token mechanism which I think is much of the reason for why we are always logged in on different web services like Facebook, KZread, etc.

Have I understood correctly: B has a long term ticket from T, but A does not. Why is that? Are they exchanged without involvement from S?

@eddievhfan1984

4 жыл бұрын

Presumably, B has already been preloaded with the K_bt key upon installation/configuration, and does not need to talk to S. Otherwise, it did the same dual-step authentication A did ages ago, but as a trusted server, it was granted a longer-term ticket than client connections would be.

@lawrencedoliveiro9104

4 жыл бұрын

@@eddievhfan1984 The server doesn’t need any tickets; only the client does.

@KnakuanaRka

4 жыл бұрын

Kyle Tekaucic But if B can get a long-term key with T, why does A need to go through S to get it?

@lawrencedoliveiro9104

4 жыл бұрын

A never gets that key. It only gets tickets encrypted with that key.

How do you get SAML to work with Kerberos?

How does the initial exchange for the long term password work?

Great video. Just wondering, in an Active Directory scenario does the encryption process utilize the TLS cipher suites available on the servers? Which is to say Kerberos has a dependency on the TLS protocol level and ciphers suites available on the host and server? Or does the Kerberos mechanism have it's own encryption protocol that is consistent across all Windows OS levels?

@TheN9nth

3 жыл бұрын

I believe every endpoint will need to utilise it's own encryption at some point when sending securely to the KDC. The host/server and Kerberos agree upon an encryption algorithm when initially establishing their long-term symmetric key.

Someone who knows, correct me if i'm wrong; So basically, per-user unique keys are stored in a central server (created when they first sign up), and this key generates more keys when user wants to talk to peripherals connected to the server. (peripherals as other users etc) If this is correct, my follow up question is, while the user is signing up the first time, how is his 'password' sent over? Public Key system? Then quantum cracking over first step will get the password & decrypt all the tickets the server produces later on.

@DDvargas123

4 жыл бұрын

I was thinking the same question ;o;

@Lttlemoi

4 жыл бұрын

I'd assume some side channel is used to set up an initial password or in a controlled environment, all users might start out with a default password that they are required to change immediately after the first authentication.

@keithd7904

4 жыл бұрын

The initial password has to be setup on the authentication server when the user gets created. For example with Active Directory an account cannot be enabled until a password is assigned to it first.

@setudesai

4 жыл бұрын

AFAIK in the active directory and kerberos systems you don't sign up per se. An admin user registers a new account and gets given a temporary password which is to be changed upon first login. This way even on first authentication the password is already there which is used tp encrypt the communication.

@Don-Carillo

4 жыл бұрын

So the KDC doesn't actually hold the user’s password, just a set of keys derived from the principles password. Is that right?

How does B recieve Kab from t in order to decrypt the message?

how does this compare to single sign on methods such as openid?

Amazing video! Thank you!!

@5:50 Why use S for Authentication service and T for Ticket Service? I had to watch that twice because that acronym mix up got me. I wish you had drawn A for Authentication.

Shouldn't the (encrypted) response ticket itself be encrypted by the session key aswell so that a 3rd party cannot reuse that ticket?

Has anyone managed to decrypt what's in the enclosure?

Really great video, helped a lot.

And when you register to create your account, what kind of encryption does it use? Because the creation of the account seems to be quite important as well

@drdca8263

4 жыл бұрын

I’m guessing this is an “out of band” thing. Either that or someone who already has an account connects to the server to create your account? My experience at work is that when they create your account, they assign a temporary password which you use to log in, and then you change your password.

Just one question to fully understand this: How do encrypt a shared secret like K at symmetric and share it with T so T can decrypt the shared secret? Or is there no need to do this?

@li5up6

4 жыл бұрын

The shared secret is encrypted by the Ks,t a long term key that S and T use to communicate. It sends you it aka the ticket granting ticket which you send to T to begin talking to it

If I followed along right, we start off assuming only a Kas exists and we need to get a Kat and give the t server this Kat. But then to talk to B the t server just talks to B with a Kbt? Where does this Kbt come from, how does the server contact you securely without passing through S first?

does the authentication server and the ticket server need to be separate services talked to separately? or is it just to optimize resources in some way, and would work _okay_ if they were just one service that did both jobs combined with computer A just talking to the server once?

@sjbuttonsb

4 жыл бұрын

They can be on the same server, but it is important that they are logically separate. For one thing keeping them modular allows you to have duplicates of either server, for load, and DOS defense purposes.

@Acorn_Anomaly

4 жыл бұрын

Initially, the authentication service and TGS were envisioned to be separate machines, but they are usually combined now. That's the reason for the separation in the first place, and the separation remains important now for optimization, as without that second step, the user would have to keep logging in every time they needed a new ticket.

Could you guys do a video on prime order elliptic curves and their applications in commitment schemes, and zero knowledge proofs?

If "ticket server" sends Kbt{Kab, A, L}, and if A knows Kab, A and L-- A can get Kbt... right?

why would you not directly get access from S to B? logging?

What is inside that terrarium behind you my dude?

@Abby_Liu

4 жыл бұрын

a three-headed dog

The first time my machine gets a long term key I need to present the 'Server' with my username/password. How does the server then return the long term key to my machine without using asymmetric encryption?

@TheThaelina

3 жыл бұрын

Your machine generates the Kas key the same way that S did using your account credentials.

Well explained thanks!

Why doesn't 'S' send the ticket granting ticket (first red message) to 't' itself instead of having 'a' send it to 't', similarly why doesn't 't' do that with 'b'?

Mike you should be a Professor at MIT or Harvard ! You are the best !

Excellent!

Why does b have a long-lasting key with t? What if a wants to share its files with the network (act as a server as well)? Would it need a long-lasting key with t as well? How does getting that key work?

@KnakuanaRka

4 жыл бұрын

André Silva Yeah, that part doesn’t quite make sense.

Question: around minute 8: how did A and the server S started communicating securely in the first place? can't someone just sniff the content of the messages from A to S to get the password? In other words, how did A and S exchanged shared key in the first place?

@sajukkhar

4 жыл бұрын

The computer (at least on Windows) needs to join the domain with an administrator account that is trusted that is where it gets its own account and key.

great video! thank you!

Question: Does B have a permanent Ktb key, or how did it get hold of it??

@TheN9nth

3 жыл бұрын

B has to authenticate through S to create a key with T at some point, just like any other device. Difference is that the key it generates will last a lot longer usual before needing to be renewed again.

this guy is just amazing ! great explanation =)

this guy is amazing at explaining

If "a" sends "b" a ticket encrypted with 'bt', how would "b" gets a ticket 'bt' from ticket granting server as it has 'bs' as long term key.. Will it go for authentication server and gets a ticket to communicate with ticket granting server?

@JivanPal

4 жыл бұрын

B is a machine, not a user. B will have already established the key Kbt to talk with T before waiting for connections from users such as A.

An interesting thing that should be mentioned is that the that KaT key contains you list of group memberships so when accessing the file server it can do authorisation without contacting the domain controller.

@dekeonus

4 жыл бұрын

only in AD, groups (and for that matter system users) aren't part of the kerberos protocol

@KnakuanaRka

4 жыл бұрын

Speaking of Kat, A had to go through S to get that, so how does B know Kbt when A sends it a message encrypted with that?

you forget that's its a remote interview, well done! also i love a vid on my field of expertise and still has some new details for me, which causes me to tinker with AD a bit more. thanks! :)