The process of authentication requires believe it or not a lot of encryption.
Now think about this for a minute.
Let's come up with a very simple scenario let's say I've got some little client system and I'm wired
over to some kind of server system so if I want to actually authenticate to this guy I'm going to have
to pass it again keep it simple here.
Let's just go with the username and password.
So if I don't have any form of encryption just the process of getting authenticated to this server thing
over here means I'm going to be passing a username and password along my wire or wireless or whatever
it might be in the clear.
I mean it would be really easy for a bad guy to intercept this and to get my username and password which
is what we call a bad thing in this business so when we talk about authentication there's over the years
have been a number of different ways to do authentication which encrypt or protect the credentials of
the person who's trying to be authenticated.
So what I want to do in this episode is kind of do a march through of the different types authentication
methods we've seen over the years.
There are some very old ones which are on the security plus So we've got to know them but I'm going
to take it all the way up to the most modern authentication method so let's go through this one authentication
at a time.
The first type of authentication method I want to talk about is password authentication protocol or
pap.
PAP is while the oldest authentication method that's both on the security plus and well it's the oldest
one I ever used and I'm old.
So anyway PAP is pretty easy so what I've got here in front of me is I've got a client system and I've
got a server system.
So what I want to do here is I want to get authenticated PAP is disturbingly easy with PAP.
All I do is I send my username and password in the clear.
PAP is not anything that we use anymore however make sure you know it for security plus.
Next I want to talk about challenge handshake authentication protocol or chap.
Now chap is also a very old authentication protocol.
In fact it is the first authentication protocol that was used within the PC world to perform some form
of protection to the authentication process.
So to watch champ in action what I have here again is my client system in my server system and this
client system wants to authenticate to the server system.
So again just keep it to usernames and passwords because that's really all chap could do.
First you need to understand that the server and the client already have a password stored in them there's
a key on each one of these devices.
So when he wants to authenticate the first thing he does is sends a hey may I authenticate message over
to the server.
Now the server hears that message and what he does is because he has the key.
He then takes and creates a challenge message.
Now he won't send these because setting the key in the clear would be a bad idea.
But what he does instead is he creates a hash of these two values and then sends the hash along with
the challenge message over to the client.
Now the client because he has the key to be able to put it all back together.
He can generate that hash.
So he'll go ahead generate that hash send it back to the server and the end result of this is just by
comparing hashes.
They can confirm whether they have the same key or not.
Now the beautiful part chap is that no passwords are being passed.
It's really just hashes.
So there are small problems with it but in general chap has been around for a long time and we still
see it used in a few situations.
Next is enty land manager and land manager has been around.
Well pretty much as long as there's been authentication in Windows now the land manager isn't used in
the more advanced windows authentication methods that's Kerberos which we're going to be talking about
here shortly but we still use and Thailand manager when we're having two window systems in a workgroup
that are logging into each other so as long as you don't have a domain controller even the most modern
version of Windows still does and LAN Manager Oh and by the way we're up to the land manager version
too.
So let's watch this take place.
Now if you were watching CHEP this is going to look really kind of similar.
So here we have our client and here we have a server.
Now in this case the key is going to be these red blocks.
Now what we want to do is authenticate this client to that server but we don't want to pass our key
out in the clear.
So what we're going to do is we're going to start an initial hello hello kind of thing and make sure
each person is there and what we're going to do it's a little bit different this time is that each side
is going to have a challenge message and then that challenge message is then hashed and now we have
each side challenging the other side and through some pretty interesting mathematical mumbo jumbo you
can actually generate the key and verify that we have the same key going through that process itself.
So any land manager really is kind of like double CHEP where we both have the client and the server
authenticating with each other.
Now let's talk about the famous Kerberos authentication protocol.
Kerberos is a very interesting authentication method because it's really only used in one place and
that is authenticating to Windows domain controllers.
So that means a lot of people use it.
So even though it's pretty much only used by Microsoft to logon to domain controllers the widespread
popularity of Windows domain networks means just about all of us use kerberos So let's watch Kerberos
in action now.
First of all what I have here are three computers.
Here's my client computer and this is just a file server it's got some folders I want to access to.
But here in the middle is a domain controller.
Now when we're talking Kerberos the domain controller is known as the KDC or the key distribution center.
But within that domain controller there's really two main functions.
There's the authentication service and then there's the ticket granting service.
Now these guys are listening in on TCAP and UDP port 88 listening for Kerberos stuff to happen.
So let's watch this take place now the first thing I do when I come in the morning is I log into the
domain on my computer so when I do my initial log in I will go through and do a nicely encrypted hash
log in.
But once that log in takes place the authentication service then provides me this little guy.
This is a ticket granting ticket.
The TGT shows that I am authenticated to the domain and I'm not authorized yet but I'm authenticated
to the domain.
Now if you're a Windows person this TGT has a more common name we call it the CID or security identifier.
And anybody who works on Windows systems has probably seen the said when you've actually seen the Kerberos
TGT.
Pretty cool huh.
All right.
So I'm authenticated to the network but I'm not authorized to any resources.
So if I actually want to get to something what I'll do is I'll take my TGT and I will take it back to
the domain controller.
But in this case I'm going over to the ticket granting service now the ticket granting service knows
what I'm allowed to access all over the domain so he'll take this.
I keep a copy for myself.
He'll take this and he will generate me a session key.
So this session key and actually works through the server as well.
The session key allows me to access one particular set of resources.
So for me to access one server I'll have a session key.
Now if I need to go anywhere else on the domain I'm going to have to go through this process again and
a new session key is derived every time.
So these are the basics of how Kerberos works.
It's really pretty cool.
The last thing I'd like to talk about is security assertion.
Markup Language and lightweight directory access protocol.
Now the security assertion markup language and the lightweight directory access protocol Well they're
not really authentication methods but they tie in so closely that I feel that this is the right place
to talk about and so let's get up real quick.
First the security assertion markup language better known as Sammul is used exclusively for web applications
so if you're developing a web application and you want people to be able to log into that application
this is what you Sammael is an incredibly powerful tool.
And if you've ever logged into almost any web application there's a good chance you've already used
it and you didn't even know it.
The other one is lightweight directory access protocol better known as El damp when you're authenticating
to something.
There's usually some process where somebody has to access someone else's directory.
Now in Windows we have active directory but we see this all over the place so el Dabb isn't really authentication
but more of a structured language that allows one computer to go into somebody else's directory and
query it and update it and do whatever it needs to do.
So we see elde app used a lot.
In fact the main process by which we access resources within Windows is based heavily on eldership.
Now the nice part about this is that's all you really need to know.
Well except for one more thing elde app uses TZP and UDP port 389.
Make sure you know it for the test.