Difference between SSL and Kerberos authentication?

ssl kerberos traffic netmon
Layla picture Layla · Sep 21, 2008 · Viewed 47.1k times · Source

I am trying to understand what's the actual difference between SSL and Kerberos authentications, and why sometimes I have both SSL traffic and Kerberos. Or does Kerberos use SSL in any way?

Anyone could help? Thank you!

Answer

Chris picture Chris · Sep 21, 2008

SSL uses public key cryptography:

  1. You (or your browser) has a public/private keypair
  2. The server has a public/private key as well
  3. You generate a symmetric session key
  4. You encrypt with the server's public key and send this encrypted session key to the server.
  5. The server decrypts the encrypted session key with its private key.
  6. You and the server begin communicating using the symmetric session key (basically because symmetric keys are faster).

Kerberos does not use public key cryptography. It uses a trusted 3rd party. Here's a sketch:

  1. You both (server and client) prove your identity to a trusted 3rd party (via a secret).
  2. When you want to use the server, you check and see that the server is trustworthy. Meanwhile, the server checks to see that you are trustworthy. Now, mutually assured of each others' identity. You can communicate with the server. 2

Related questions

Security & Authentication: SSL vs SASL

My understanding is that SSL combines an encryption algorithm (like AES, DES, etc.) with a key exchange method (like Diffie-Hellman) to provide secure encryption and identification services between two endpoints on an un-secure network (like the Internet). My understanding is …

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More