What happens step by step in phase 1 of Kerberos, the exchange between client and Authentication Server?

The client sends an AS-REQ (user ID, the TGS as requested service, desired lifetime); the AS looks the user up, creates a TGS session key, encrypts it with the client's secret key, packs it also into a TGT encrypted with the KDC key, and sends both; the client decrypts the session key with its password-derived key and caches both.

* Phase 1: the password only ever turns into a key on the client; the AS reply is useless without it. *

1. The user enters user ID and password on the laptop; the client derives the client secret key from the password.
2. The client sends the AS-REQ (Authentication Service Request): user ID and optionally network addresses, the requested service (the TGS), the requested TGT lifetime.
3. The AS checks the user against its database.
4. It creates a TGS session key and encrypts it with the client secret key from its database.
5. It creates the TGT, puts the same TGS session key into it, and encrypts the TGT with the KDC key.
6. The client receives both (AS-REP). It decrypts the TGS session key with its client secret key and stores it in the credential cache; the TGT it stores still encrypted.

After this phase the client holds a TGS session key in clear and a TGT it cannot read, and the password can be forgotten.

Go deeper:

• RFC 4120, Section 3.1: The Authentication Service exchange — AS-REQ and AS-REP and every check the KDC makes.
• Microsoft Learn: Kerberos authentication overview — how Windows uses the same exchange at domain logon.