Every morning, millions of people type a password into a Windows machine once, then open file shares, printers, intranets and databases all day without ever being asked again. The machinery behind that quiet magic is Kerberos — a protocol with a fearsome textbook reputation (named after the three-headed dog of Greek myth, taught with diagrams of arrows everywhere) that becomes almost obvious once you swap the diagrams for a festival.
The festival model
Imagine a huge music festival with dozens of venues, each with its own door staff. Checking everyone's ID at every door would be miserable, so the festival does what festivals do:
- The box office (Authentication Service): you prove who you are once — ID checked properly — and receive a wristband. In Kerberos this is the TGT (Ticket-Granting Ticket), and the box office lives inside the KDC (Key Distribution Center) — which, in a Windows network, is the domain controller. Your password never travels across the network; the exchange uses keys derived from it.
- The ticket desk (Ticket-Granting Service): want into a specific venue — say, the file server? Show your wristband at the desk and receive a venue-specific ticket (a service ticket): valid for that venue only, for a limited time, non-transferable.
- The venue door (the service): the file server checks your service ticket's cryptographic seal and lets you in. Crucially, the venue never phones the box office — the ticket itself is verifiable, because it's sealed with a secret the venue shares with the KDC. That's the scalability trick: the central authority isn't consulted on every access.
Everything Kerberos-y follows from the model. Tickets expire (wristbands are dated — limiting how long stolen ones work). Tickets are encrypted and bound to you (names checked against wearers). And the entire day of seamless access is just: one box-office visit, then wristband → desk → venue, repeated invisibly, service after service.
Where the model earns its Summit badge: attacks on Kerberos are attacks on the ticketing. Steal a ticket from a machine's memory and replay it — that's pass-the-ticket. Request tickets for services and crack their encryption offline to recover a service account's weak password — that's Kerberoasting, a staple of real intrusions and the best argument you'll ever meet for long random service-account passwords. And if attackers steal the box office's own master stamp (the krbtgt account's key), they can print wristbands — arbitrary, long-lived, for anyone, including invented users. That's the golden ticket, it means total domain compromise, and it's why recovering from one requires re-keying the box office itself, twice.
Why care, beyond exams? Because Kerberos quietly underpins Active Directory — still the identity backbone of most enterprises — and because the festival model is the fastest route to understanding both the daily support tickets ("clock skew" errors: your watch disagrees with the box office's, so your tickets look forged) and the incident reports (nearly every major Windows-network intrusion story includes at least one of the ticket attacks above). Three-headed dog; one wristband; whole protocol.