What is preauthentication?
As mentioned in Question 1.18, one weakness in Kerberos is the ability to doan offline dictionary attack by requested a TGT for a user and just tryingdifferent passwords until you find one that decrypts the TGT successfully.One way of preventing this particular attack is to do what is known aspreauthentication. This means to simply require some additionalauthentication before the KDC will issue you a TGT.The simplest form of preauthentication is known as PA-ENC-TIMESTAMP. This issimply the current timestamp encrypted with the user’s key.There are various other types of preauthentication, but not all versions ofKerberos 5 support them all.————————————————————Subject: 1.20.
As mentioned in Question 1.18, one weakness in Kerberos is the ability to do an offline dictionary attack by requested a TGT for a user and just trying different passwords until you find one that decrypts the TGT successfully. One way of preventing this particular attack is to do what is known as preauthentication. This means to simply require some additional authentication before the KDC will issue you a TGT.
As mentioned in Question 1.18, one weakness in Kerberos is the ability to do an offline dictionary attack by requested a TGT for a user and just trying different passwords until you find one that decrypts the TGT successfully. One way of preventing this particular attack is to do what is known as preauthentication. This means to simply require some additional authentication before the KDC will issue you a TGT. The simplest form of preauthentication is known as PA-ENC-TIMESTAMP. This is simply the current timestamp encrypted with the user’s key. There are various other types of preauthentication, but not all versions of Kerberos 5 support them all. ———————————————————— Subject: 1.20. Why do I need to synchronize my system clocks to run Kerberos? The actual verification of a client’s identity is done by validating an authenticator. The authenticator contains the client’s identity and a timestamp. To insure that the authenticator is up-to-date and i
