Skip to main content

3. Message Exchanges

The following sections describe the interactions between network clients and servers and the messages involved in those exchanges.

Overview​

The Kerberos protocol consists of several message exchange patterns that enable authentication and secure communication. This chapter describes the detailed message flows and requirements for each exchange type.

Exchange Types​

Authentication Service (AS) Exchange​

The AS exchange is used when a client first authenticates to the Kerberos system to obtain a Ticket-Granting Ticket (TGT).

Client/Server Authentication Exchange​

Used when a client authenticates directly to an application server using a service ticket.

Ticket-Granting Service (TGS) Exchange​

The TGS exchange is used to obtain service tickets using an existing TGT.

Secure Message Exchanges​

  • KRB_SAFE: Provides integrity protection for messages
  • KRB_PRIV: Provides confidentiality and integrity protection
  • KRB_CRED: Used for credential forwarding

User-to-User Authentication​

Supports peer-to-peer authentication scenarios.

Reference​

For complete technical details of all message exchanges, refer to RFC 4120 Section 3.