KDCs

KDCs, or Key Distribution Centers, are a central component of the Kerberos authentication protocol. They are responsible for issuing tickets that prove a user's identity to network services. A KDC comprises two logical services: the Authentication Service (AS) and the Ticket Granting Service (TGS). The KDC also maintains a database of principals (users, services) and their secret keys, typically protected and backed by a directory service.

Operation begins when a client authenticates to the AS using credentials (often a password). The AS verifies the credentials and issues a Ticket Granting Ticket (TGT), encrypted with the client's key. When the client wants to access a network service, it presents the TGT to the TGS to obtain a service ticket for that specific service. The service ticket is encrypted with the service's key, ensuring only the service can read it. Tickets have limited lifetimes; clients must re-authenticate after expiry. Time synchronization is essential, as Kerberos relies on timestamps to prevent replay attacks.

Security and deployment considerations include recognizing that KDCs are high-value targets and should be hardened, audited, and protected from compromise. In Windows environments, the KDC is integrated with Active Directory. In Unix-like systems, MIT Kerberos or Heimdal implementations are common. Redundancy is achieved via multiple KDCs and proper replication; clock synchronization is typically enforced with NTP.

History and scope: Kerberos was developed at MIT in the 1980s and has since become a standard in many enterprise networks, including integration with organizational directories and cloud services.