Kerberos Papers and Documentation

Kerberos Papers

• B. Clifford Neuman and Theodore Ts'o. Kerberos: An Authentication Service for Computer Networks, IEEE Communications, 32(9):33-38. September 1994. html

• John T. Kohl, B. Clifford Neuman, and Theodore Y. T'so, The Evolution of the Kerberos Authentication System. In Distributed Open Systems, pages 78-94. IEEE Computer Society Press, 1994. text , postscript

• J. G. Steiner, B. Clifford Neuman, and J.I. Schiller. Kerberos: An Authentication Service for Open Network Systems. In Proceedings of the Winter 1988 Usenix Conference. February, 1988. (Version 4) text , postscript

• B. Clifford Neuman and Jennifer G. Steiner. Authentication of Unknown Entities on an Insecure Network of Untrusted Workstations. In Proceedings of the Usenix Workshop on Workstation Security, Portland, OR. August, 1988. postscript

Specifications

Protocol

• John Kohl and B. Clifford Neuman. The Kerberos Network Authentication Service (Version 5). Internet Request for Comments RFC-1510. September 1993. text

• S.P. Miller, B. C. Neuman, J. I. Schiller, and J.H. Saltzer. Section E.2.1: Kerberos Authentication and Authorization System. Project Athena Technical Plan, MIT Project Athena, Cambridge, Massachusetts, October 1988. (Version 4) text , postscript

Proposed Protocol Extensions

• B. Clifford Neuman The Kerberos Network Authentication Service (V5) text

• B. Clifford Neuman, Brian Tung, and John Wray. Public Key Cryptography for Initial Authentication in Kerberos. text

• Matthew Hur, Brian Tung, at el. Public Key Cryptography for Cross-Realm Authentication in Kerberos text

• Mike Swift Initial Authentication and Pass Through AuthenticationUsing Kerberos V5 and the GSS-API (IAKERB) text

Application Programming Interface

• J. Linn. Generic Security Service Application Program Interface. Internet Request for Comments RFC-1508. September 1993. text

• J. Linn. Generic Security Service API: C Bindings. Internet Request for Comments RFC-1508. September 1993. text

• J. Linn. Generic Security Service Application Program Interface - Version 2, Update 1 RFC-2743. text

• J. Wray. Generic Security Service API Version 2 : C-bindings RFC-2744. text

Using Kerberos for Authorization

• B. Clifford Neuman. Proxy-Based Authorization and Accounting for Distributed Systems. In Proceedings of the 13th International Conference on Distributed Computing Systems, pages 283-291, May 1993. pdf

• Marlena E. Erdos and Joseph N. Pato. Extending the OSF DCE Authorization System to Support Practical Delegation. In Proceedings of the 1993 PSRG Workshop on Network and Distributed System Security, February 1993. postscript

• Paper from the UK
• Paper from HP UK (if uses Kerberos)

Discussion and Critique of Kerberos

• S. M. Bellovin and M. Merritt. Limitations of the Kerberos Authentication System. In Proceedings of the Winter 1991 Usenix Conference. January 1991. postscript

• B. Clifford Neuman and Stuart G. Stubblebine. A Note on the Use of Timestamps as Nonces. Operating Systems Review, 27(2):10-14, April 1993. (unrefereed) compressed postscript

• B. Clifford Neuman. Protection and Security Issues for Future Systems. In Proceedings of the Workshop on Operating Systems of the 90s and Beyond. Dagstuhl Castle, Germany. July 1991. compressed postscript

Tutorials

• Bill Bryant. Designing an Authentication System: a Dialogue in Four Scenes. 1988. Afterword by Theodore Ts'o, 1997. html

• Brian Tung. The Moron's Guide to Kerberos. html

Variants and Derivatives of Kerberos

• Yaksha
• Sesame a network security project of the European Community