What is Kerberos, and what are its goals?

Kerberos is a network authentication protocol for secure authentication of principals over an insecure network between trustworthy hosts, with a trusted third party (the Kerberos server) doing the authentication; it also distributes session keys and provides single sign-on within one administrative domain.

The setting is a campus or company network in which anyone might sniff or inject packets, but the machines themselves (the user's laptop, the servers) are assumed to be secure. In that world Kerberos wants to:

• Authenticate principals: a principal is any subject with an identity in Kerberos: users, PCs and laptops, and servers or services.
• Exchange session keys: after authentication, client and service share a fresh secret key they can use to protect their further communication.
• Provide single sign-on (SSO): the user types the password once and can then use printers, network file systems (NFS), databases and other services of the same domain without logging in again.

It does all this with symmetric cryptography only and without ever sending the password over the network. It is based on the Needham-Schroeder protocol (1978).

Go deeper:

• Computerphile: Taming Kerberos (Mike Pound) — a 16-minute whiteboard walk-through of the whole idea.
• Kerberos (Wikipedia) — history, protocol description, drawbacks and operating-system support.
• MIT: Kerberos, the network authentication protocol — the home of the reference implementation and its documentation.