[English] You Do (Not) Understand Kerberos

Understanding how Kerberos works, but also WHY it works the way it does

[hiuyip]

Your explanation is most clear I found in YouTube many thanks 🙏🏻🙏🏻🙏🏻

[daniel]

The best explanation of Kerberos in the whole internet 👏

[lisam]

I am a beginner, I watched your 5 videos about Kerberos and delegation, I learned a lot, I really appreciate your efforts, I will continue to watch the other videos to learn more about Active Directory and Windows security. Thank you again for your excellent work.🍻🍻🍻🍻

[wolfrevokcats]

Timestamp. Hope this helps

0:00 Intro
2:03 Disclaimer
2:24 Agenda
2:50 Project Athena . Massachusetts Institute of Technology (MIT)
5:37 Kerberos Versions
6:40 Kerberos v5 Additions
7:14 Microsoft and Kerberos - Kerberos vs was introduced in Windows Server 2000
8:29 The Problem
16:04 How (not) to use a Service
18:09 How to use a Service
22:56 Single Sign-On (SSO)
25:45 Improvements • The Authentication Server (AS) allows centralising secret keys
26:52 Tickets
31:54 Authenticators (cont.) - Authenticators are created and encrypted by the client with session keys
41:37 Kerberos in Active Directory • All Kerberos actors need to have the time synchronized to a central time source Lotherwise ticket expirations and timestamps...
44:08 CAPSULE.CORP
47:18 service PrincipalName (SPN)
50:13 Kerberos Messages
53:59 AS-REQ
55:12 AS-REP
57:01 What's within a TGT
58:52 TGS-REQ

[mohanrajaeswaran]

Excellent, appreciate all your efforts. Please provide more videos and it is supportive for learning. Kerberos is a tricky topic but you have explained it nicely. Thank you.

[mahmoudabdullah]

Thank you so much for the effort you put into these videos!

[wolfrevokcats]

Thank you for publishing this video in English. Your other videos in Spanish such as constrained vs unconstrained delegation look very interesting too, unfortunately I don't understand Spanish. Not many people talk about these topics on youtube

[branchederose]

Your videos are so greaaat OMG could you please make some on ADCS ? :)

[Rickety]

If Kerberos is Authentication, then the Service Ticket is the Authorization....?
I love your explanations and you do a great job at explaining the "why".

[victortisme]

The 31:54 section is clear but somewhat recuses the simplified version provided by the CISSP official study guide (Chapt. 14).
In their version, the client & AS rely not in a symmetric key, but on a hashed password. I'm not familiar enough with the process to understand which one is correct. Your version seems to make more sense as it allows the encryption of the authenticator. And since they do not mention the authenticator but still mention the encryption, your version sounds more sensible.

Are those two different usecases?

Even more confusing is that Thor Pedersen, who recommends your video in his course, says that the initial TGT request is made in clear text.

So can you confirm whether your version is the correct one or whether it is slightly different from how it works?

Thanks again!

[ivaansolerr_]

so the secret key is the password encrypted?

[vigneshc]

Can we have the ppt or pdf for later referencr