security - 为什么 Kerberos 协议(protocol)不具有完美的前向保密性？

Question

为什么 Kerberos 协议(protocol)没有功能 perfect forward secrecy ？

Answer 1

technical reason如下:

The Kerberos protocol in its basicform does not provide perfect
forward secrecy for communications.If traffic has been recorded by aneavesdropper, then messages encryptedusing the KRB_PRIV message, ormessages encrypted usingapplication-specific encryption underkeys exchanged using Kerberos can bedecrypted if the user's,
application server's, or KDC's key issubsequently discovered. This isbecause the session key used toencrypt such messages, when
transmitted over the network, isencrypted in the key of the
application server. It is alsoencrypted under the session key from
the user's TGT when it is returned tothe user in the KRB_TGS_REP
message. The session key from the TGTis sent to the user in the
KRB_AS_REP message encrypted in theuser's secret key and embedded in
the TGT, which was encrypted in thekey of the KDC. Applications
requiring perfect forward secrecy mustexchange keys through mechanismsthat provide such assurance, but mayuse Kerberos for authentication ofthe encrypted channel establishedthrough such other means.

基本上完美的前向保密会增加协议(protocol)的额外开销，而这对于许多应用程序来说是不必要的。如果您需要 PFS，那么您可以添加它。对于大多数 Kerberos 用户来说，最重要的是速度。如果您在世界各地有数万名员工同时进行身份验证，那么 PFS 所需的开销将过于昂贵且不切实际。