How does the Needham-Schroeder symmetric-key protocol work, and which weakness did Kerberos fix?
Alice and Bob each share a secret key with an authentication server (K_A, K_B); the server hands Alice a fresh session key plus a "ticket" for Bob encrypted under K_B, and a nonce challenge proves both hold the key; its flaw is that an old, compromised session key can be replayed, which Kerberos closes with timestamps and lifetimes.
* Needham-Schroeder: the trusted server distributes a session key; the nonce exchange proves possession of it. *
- Alice → AS:
A, B, N_A(who she is, whom she wants to talk to, a fresh nonce). - AS → Alice:
{N_A, B, SK, {SK, A}K_B}K_A. Only Alice can open it; inside she finds the session key SK and a sealed package for Bob. - Alice → Bob:
{SK, A}K_B. Only Bob can open it, and he learns SK and that the server vouches for Alice. - Bob → Alice:
{N_B}SK, a challenge. - Alice → Bob:
{N_B - 1}SK, proving she holds SK.
Mutual authentication follows because only the holder of K_A could read message 2 and only the holder of K_B could read message 3. The weakness (Denning-Sacco): message 3 contains nothing fresh. An attacker who once learns an old SK can replay the old message 3 and impersonate Alice. Kerberos adds timestamps and ticket lifetimes, and splits the server into two roles (AS and TGS).
Go deeper:
Needham-Schroeder protocol (Wikipedia) — the message sequence, the replay attack and how timestamps fix it.