Kerberos [KN93][KNT94] is an authentication service developed by the Project Athena team at MIT, based on a 1978 paper by Needham and Schroeder [NS78]. The first general use version was version 4. Version 5, which addressed certain shortfalls in version 4, was released in 1994. Kerberos uses secret-key ciphers (see Question 1) for encryption and authentication. Version 4 could only use DES (see Question 64). Unlike a public-key authentication system, it does not produce digital signatures (see Question 3); Kerberos was designed to authenticate requests for network resources rather than to authenticate authorship of documents. Thus, Kerberos does not provide for future third-party verification of documents.
In a Kerberos system, there is a designated site on each network,
called the Kerberos server, which performs centralized key management
and administrative functions. The server maintains a database
containing the secret keys of all users, authenticates the identities
of users, and distributes session keys to users and servers who
wish to authenticate one another. Kerberos requires trust in a
third party, in this case the Kerberos server. If the server were
compromised, the integrity of the whole system would be lost.
Public-key cryptography was designed precisely to avoid the necessity
to trust third parties with secrets (see Question 3). Kerberos
is generally considered adequate within an administrative domain;
across domains, the more robust functions and properties of public-key
systems are often preferred. There has been some developmental
work in incorporating public-key cryptography into Kerberos [Gan95].