nerdexam
GIAC

GSLC · Question #21

Kerberos is a computer network authentication protocol that allows individuals communicating over a non-secure network to prove their identity to one another in a secure manner. Which of the…

The correct answer is A. Kerberos requires continuous availability of a central server. C. Dictionary and brute force attacks on the initial TGS response to a client may reveal the subject's D. Kerberos requires the clocks of the involved hosts to be synchronized. Kerberos is a symmetric-key network authentication protocol with specific infrastructure, cryptographic, and operational requirements that distinguish it from asymmetric schemes.

Security Architecture & Engineering

Question

Kerberos is a computer network authentication protocol that allows individuals communicating over a non-secure network to prove their identity to one another in a secure manner. Which of the following statements are true about the Kerberos authentication scheme? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AKerberos requires continuous availability of a central server.
  • BKerberos builds on Asymmetric key cryptography and requires a trusted third party.
  • CDictionary and brute force attacks on the initial TGS response to a client may reveal the subject's
  • DKerberos requires the clocks of the involved hosts to be synchronized.

How the community answered

(55 responses)
  • A
    95% (52)
  • B
    5% (3)

Why each option

Kerberos is a symmetric-key network authentication protocol with specific infrastructure, cryptographic, and operational requirements that distinguish it from asymmetric schemes.

AKerberos requires continuous availability of a central server.Correct

Kerberos depends entirely on the Key Distribution Center (KDC) for issuing tickets; if the KDC is unavailable, no user can authenticate and all network services requiring Kerberos become inaccessible.

BKerberos builds on Asymmetric key cryptography and requires a trusted third party.

Kerberos is built on symmetric key (shared secret) cryptography, not asymmetric key cryptography; while it does use a trusted third party (the KDC), the claim about asymmetric cryptography is technically incorrect and makes the entire statement false.

CDictionary and brute force attacks on the initial TGS response to a client may reveal the subject'sCorrect

The AS-REP message returned by the Authentication Server is encrypted with a key derived from the user's password, so an attacker who captures this packet can perform offline dictionary or brute-force attacks to recover the password without further network interaction.

DKerberos requires the clocks of the involved hosts to be synchronized.Correct

Kerberos embeds timestamps in tickets to detect and reject replays, requiring all participating hosts to maintain clock synchronization within a configurable skew window (default 5 minutes); clock drift beyond this threshold causes ticket validation to fail.

Concept tested: Kerberos protocol requirements, cryptographic model, and attack surface

Source: https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview

Topics

#Kerberos#authentication protocol#TGS#clock synchronization

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice