0

In kerberos authentication, the encrypted messages are added a timestamp, in order to prevent replay attacks. Basically once someone decrypts a message that was sent for him, it compares the timestamp with the current time, and if it can tolerate the time difference between the time the message was encrypted and the current time, it considers it as valid.

But what will happen if we put a futuristic timestamp on a kerberos ticket?

what will happen if a KDC decrypts a ticket at 17:34, but the current timestamp is something like 18:28?

If it will let me in and validate my ticket, what prevents me of putting the timestamp for 100 years in the future, and thus getting unlimited timestamp on every ticket I send?

1

1 Answer 1

0

Depends on the particular version and configuration of the Kerberos library in question, but generally they all check if the timestamp is within a specific window of time. E.g. now +/- 5 minutes, instead of greater than now.

And it's not so much that the client sent it now, it's that the client sent a fresh request, so the KDC may in fact return an error indicating it should shift it's request time to match the KDC time which is good enough because it indicates the client is able to actively use the client credential.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .