🎫 Hybrid Kerberos Authentication System

Complete Kerberos authentication protocol implementation with hybrid encryption (RSA 2048-bit + AES 256-bit) and JavaFX GUI

Features • Installation • Usage • Architecture • Documentation

---

📋 Table of Contents

• Overview
• Features
• Kerberos Architecture
• Installation
• Quick Start
• Technical Documentation
  • Components
  • Authentication Flow
  • Encryption
• Project Structure
• Academic Context
• Security Analysis
• Contributing
• License
• Author

---

🎯 Overview

This project implements a complete Kerberos authentication system with a modern twist - hybrid encryption combining RSA and AES. Unlike traditional Kerberos which uses symmetric encryption only, this implementation leverages both asymmetric (RSA) and symmetric (AES) cryptography for enhanced security.

What is Kerberos?

Kerberos is a network authentication protocol developed at MIT that uses tickets to allow nodes to prove their identity over a non-secure network. It's widely used in enterprise environments (e.g., Microsoft Active Directory).

Key Concepts:

• 🎫 Ticket-Based Authentication - No password transmission over network
• 🔐 Mutual Authentication - Both client and server verify each other
• 🎟️ Single Sign-On (SSO) - One login for multiple services
• ⏱️ Time-Limited Tickets - Tickets expire after 5 minutes
• 🔑 Trusted Third Party - KDC acts as authentication authority

This Implementation

Our hybrid approach combines:

• RSA 2048-bit for secure key distribution
• AES 256-bit for efficient data encryption
• JavaFX GUI for user-friendly interaction
• CSV-based Database for user management
• Comprehensive Logging for audit trails

Real-World Comparison: This is similar to how Active Directory authenticates users in Windows domains!

---

✨ Features

🔐 Authentication & Security

• ✅ Kerberos Protocol Implementation - Complete AS, TGS, SS workflow
• ✅ Hybrid Encryption - RSA 2048-bit + AES 256-bit
• ✅ Ticket-Based Authentication - TGT and Service Tickets
• ✅ Time-Limited Sessions - 5-minute ticket expiration
• ✅ Mutual Authentication - Client ↔ Server verification
• ✅ Key Distribution Center (KDC) - Centralized authentication authority
• ✅ Session Key Generation - Unique AES keys per session

💻 Application Features

• ✅ JavaFX GUI - Modern graphical interface
• ✅ User Registration - Client and server registration
• ✅ Login System - Password-based authentication
• ✅ Secure Messaging - Encrypted client-server communication
• ✅ Comprehensive Logging - Detailed audit trail (Log.txt)
• ✅ CSV Database - User credentials storage (Dataset.csv)
• ✅ Real-Time Feedback - GUI log display

🛡️ Security Features

• ✅ RSA Key Pair Generation - 2048-bit asymmetric encryption
• ✅ AES Session Keys - 256-bit symmetric encryption
• ✅ Encrypted Tickets - Secure ticket transmission
• ✅ Timestamp Verification - Prevents replay attacks
• ✅ Public Key Infrastructure - PKI-like key management
• ✅ Password-Based Authentication - Secure credential verification

---

🏗️ Kerberos Architecture

System Overview

┌──────────────────────────────────────────────────────────────────┐
│            Hybrid Kerberos Authentication System                  │
└──────────────────────────────────────────────────────────────────┘

┌─────────────┐         ┌──────────────┐         ┌─────────────┐
│   CLIENT    │────────▶│     KDC      │◀────────│   SERVER    │
│             │         │ (Key Dist.   │         │             │
│ - User ID   │         │  Center)     │         │ - Server ID │
│ - Password  │         │              │         │ - Services  │
│ - RSA Keys  │         │ - AS (Auth)  │         │ - RSA Keys  │
│             │         │ - TGS (Ticket│         │             │
└─────────────┘         │   Granting)  │         └─────────────┘
                        └──────────────┘

Three-Party Protocol

1. Client 👤

• Initiates authentication requests
• Stores user credentials
• Receives and stores tickets (TGT, Service Ticket)
• Communicates with servers using session keys

2. KDC (Key Distribution Center) 🏛️

• AS (Authentication Server) - Verifies user credentials
• TGS (Ticket Granting Server) - Issues service tickets
• Manages all public/private key pairs
• Generates session keys for secure communication

3. Server 🖥️

• Provides services to authenticated clients
• Verifies service tickets
• Maintains list of authenticated clients
• Decrypts messages using session keys

---

🚀 Installation

Prerequisites

Java 8 or higher with JavaFX support

Verify Java Installation:

java -version
# Should output: java version "1.8.0" or higher

Clone Repository

git clone https://github.com/memo-13-byte/hybrid-kerberos-system.git
cd hybrid-kerberos-system

Compile

# Compile all Java files
javac -cp src src/*.java

# Or use your IDE (IntelliJ IDEA, Eclipse, NetBeans)

---

💡 Quick Start

1. Run Application

cd src
java Main

GUI will launch automatically!

2. Register Client & Server

In the GUI:

Field	Value	Description
Client ID	alice	Unique client identifier
Password	password123	Client password
Server ID	file-server	Target server identifier

Click "Register" button

What Happens:

1. ✅ KDC generates RSA 2048-bit key pairs for client
2. ✅ KDC generates RSA 2048-bit key pairs for server
3. ✅ Client and Server registered in system
4. ✅ Keys saved to Dataset.csv
5. ✅ Confirmation in log area

3. Login (Get TGT)

In the GUI:

Field	Value
Client ID	alice
Password	password123
Server ID	file-server

Click "LogIn" button

Authentication Flow:

1. Client → KDC: Login request with credentials
2. KDC verifies password against Dataset.csv
3. KDC generates:
   • TGT (Ticket Granting Ticket) - encrypted with client's key
   • Session Key (Kc,tgs) - for Client-TGS communication
4. Client receives TGT (valid for 5 minutes)
5. ✅ Login successful!

4. Communicate with Server

In the GUI:

Field	Value
Message	Hello, secure world!

Click "Communicate with Server" button

Secure Communication:

1. Client → TGS: TGT + Server ID request
2. TGS verifies TGT validity
3. TGS generates:
   • Service Ticket - for Client-Server auth
   • Session Key (Kc,s) - for Client-Server communication
4. Client → Server: Service Ticket + Encrypted Message
5. Server verifies ticket
6. Server decrypts message using session key
7. ✅ Secure communication established!

Log Output:

Client alice authenticated successfully.
TGT issued to alice.
Service ticket for file-server issued.
Message encrypted with AES: Q2hhbmdlIG1lIQ==
Server file-server decrypted message: Hello, secure world!

---

📚 Technical Documentation

System Components

1. Main.java (JavaFX GUI)

Responsibilities:

• Graphical user interface
• User input handling
• Event listeners for buttons
• Log display management
• File logging (Log.txt)

Key Methods:

start(Stage primaryStage) // Initialize GUI
registerButton.setOnAction() // Handle registration
loginButton.setOnAction() // Handle login
communicateButton.setOnAction() // Handle messaging
log(String message) // Write to Log.txt

---

2. KDC.java (Key Distribution Center)

Responsibilities:

• Client and server registration
• RSA key pair generation (2048-bit)
• User authentication
• TGT (Ticket Granting Ticket) generation
• Service ticket issuance
• Session key generation (AES 256-bit)

Key Methods:

registerClient(String clientId, String password)
→ Generates RSA keys, stores in Dataset.csv

registerServer(String serverId)
→ Generates RSA keys for server

authenticateClient(String clientId, String password, String serverId)
→ Verifies credentials, returns true/false

generateTGT(Client client)
→ Creates encrypted Ticket Granting Ticket

generateServiceTicket(Client client, Server server)
→ Creates service ticket for client-server auth

generateSessionKey()
→ Generates 256-bit AES session key

Database Structure (Dataset.csv):

ClientID,Password,PrivateKey,PublicKey
alice,password123,MIIEvQIBADANBgk...,MIIBIjANBgkq...
file-server,,MIIEvgIBADANBg...,MIIBIjANBgkq...

---

3. Client.java

Responsibilities:

• Store client credentials (ID, password)
• Maintain TGT (Ticket Granting Ticket)
• Store service tickets
• Encrypt messages with session keys

Attributes:

private String clientId;       // Unique identifier
private String password;       // Authentication credential
private Ticket tgt;            // Ticket Granting Ticket
private KDC kdc;              // Reference to KDC

Key Methods:

requestTGT() → TicketGrant
// Request TGT from KDC

requestServiceTicket(String serverId) → Ticket
// Request service ticket for specific server

encryptMessage(String message, SecretKey sessionKey) → String
// Encrypt message using AES session key

---

4. Server.java

Responsibilities:

• Manage authenticated clients
• Verify service tickets
• Decrypt encrypted messages
• Maintain access control list

Attributes:

private String serverId;
private KDC kdc;
private Map<Client, Boolean> authenticatedClients;

Key Methods:

addAuthenticatedClient(Client client, Boolean isAuth)
// Add client to authenticated list

verifyTicket(Ticket ticket) → Boolean
// Verify service ticket validity

decryptMessage(String encryptedMessage, SecretKey sessionKey) → String
// Decrypt client message

---

5. Ticket.java

Ticket Structure:

public class Ticket {
    private String clientId;           // Client identifier
    private String serverId;          // Server identifier
    private String sessionKey;        // AES session key (Base64)
    private long timestamp;           // Creation time
    private long expirationTime;      // 5 minutes validity
}

Encryption:

• Ticket encrypted with server's public key (RSA)
• Client cannot read ticket contents
• Only server can decrypt with private key

---

6. TicketGrant.java (TGT)

TGT Structure:

public class TicketGrant {
    private String clientId;          // Client identifier
    private String sessionKey;        // Session key for Client-TGS
    private long timestamp;           // Creation time
    private long expirationTime;      // Validity period
}

Encryption:

• TGT encrypted with client's password-derived key
• Contains session key for TGS communication
• Valid for 5 minutes

---

Authentication Flow

Phase 1: Client Registration

CLIENT                                KDC
  │                                    │
  ├─── Register(clientId, password) ─▶│
  │                                    ├─ Generate RSA KeyPair (2048-bit)
  │                                    ├─ Save to Dataset.csv
  │                                    ├─ Store in clientKeyPairs map
  │                                    │
  │◀────── Confirmation ───────────────┤
  │                                    │

---

Phase 2: Authentication (Get TGT)

CLIENT                                KDC
  │                                    │
  ├─── Login(clientId, password) ────▶│
  │                                    ├─ Verify credentials (Dataset.csv)
  │                                    ├─ Generate SessionKey (Kc,tgs)
  │                                    ├─ Create TGT:
  │                                    │   - clientId
  │                                    │   - sessionKey
  │                                    │   - timestamp
  │                                    │   - expiration (now + 5 min)
  │                                    ├─ Encrypt TGT with password
  │                                    │
  │◀──── {TGT, Kc,tgs} ────────────────┤
  ├─ Store TGT                         │
  ├─ Store Kc,tgs                      │
  │                                    │

---

Phase 3: Request Service Ticket

CLIENT                                KDC/TGS                        SERVER
  │                                    │                               │
  ├─ Request ServiceTicket(serverId) ─▶│                               │
  ├─ Send: {TGT, serverId}             │                               │
  │                                    ├─ Decrypt TGT                  │
  │                                    ├─ Verify expiration            │
  │                                    ├─ Generate Session Key (Kc,s)  │
  │                                    ├─ Create Service Ticket:       │
  │                                    │   - clientId                  │
  │                                    │   - serverId                  │
  │                                    │   - Kc,s                      │
  │                                    │   - timestamp                 │
  │                                    │   - expiration                │
  │                                    ├─ Encrypt with Server's PubKey │
  │                                    │                               │
  │◀── {ServiceTicket, Kc,s} ──────────┤                               │
  ├─ Store ServiceTicket               │                               │
  ├─ Store Kc,s                        │                               │
  │                                    │                               │

---

Phase 4: Secure Communication

CLIENT                                SERVER
  │                                    │
  ├─ Encrypt(message, Kc,s) ──────────▶│
  ├─ Send: {ServiceTicket, EncMsg}     │
  │                                    ├─ Decrypt ServiceTicket (PrivKey)
  │                                    ├─ Extract Kc,s
  │                                    ├─ Verify expiration
  │                                    ├─ Decrypt message (Kc,s)
  │                                    │
  │◀──── Response ─────────────────────┤
  │                                    │

---

Encryption Mechanisms

RSA 2048-bit (Asymmetric)

Usage:

• Client/Server key pair generation
• Ticket encryption
• Session key distribution

Process:

// Key generation
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
keyGen.initialize(2048);
KeyPair keyPair = keyGen.generateKeyPair();

// Encryption (with Public Key)
Cipher cipher = Cipher.getInstance("RSA");
cipher.init(Cipher.ENCRYPT_MODE, publicKey);
byte[] encrypted = cipher.doFinal(data);

// Decryption (with Private Key)
cipher.init(Cipher.DECRYPT_MODE, privateKey);
byte[] decrypted = cipher.doFinal(encrypted);

Why RSA?

• ✅ Secure key distribution
• ✅ No shared secret needed
• ✅ Public keys can be freely distributed

---

AES 256-bit (Symmetric)

Usage:

• Session key encryption
• Message encryption/decryption
• Fast bulk data encryption

Process:

// Key generation
SecretKey sessionKey = generateSessionKey(); // 256-bit

// Encryption
Cipher cipher = Cipher.getInstance("AES");
cipher.init(Cipher.ENCRYPT_MODE, sessionKey);
byte[] encrypted = cipher.doFinal(message.getBytes());

// Decryption
cipher.init(Cipher.DECRYPT_MODE, sessionKey);
byte[] decrypted = cipher.doFinal(encrypted);
String message = new String(decrypted);

Why AES?

• ✅ Much faster than RSA
• ✅ Suitable for large messages
• ✅ Industry standard (used by NSA)

---

Hybrid Encryption Strategy

Best of Both Worlds:

┌─────────────────────────────────────────────────────────┐
│              Hybrid Encryption Architecture              │
└─────────────────────────────────────────────────────────┘

PHASE 1: Key Exchange (RSA)
  - Generate AES session key (256-bit)
  - Encrypt session key with recipient's RSA public key
  - Transmit encrypted session key

PHASE 2: Data Transmission (AES)
  - Encrypt actual message with AES session key
  - Transmit encrypted message
  
PHASE 3: Decryption (Hybrid)
  - Decrypt session key with RSA private key
  - Decrypt message with session key (AES)

RESULT:
  ✅ RSA security for key exchange
  ✅ AES performance for data
  ✅ Perfect Forward Secrecy (new key per session)

---

📁 Project Structure

hybrid-kerberos-system/
├── src/
│   ├── Main.java              # JavaFX GUI application
│   ├── KDC.java               # Key Distribution Center
│   ├── Client.java            # Client implementation
│   ├── Server.java            # Server implementation
│   ├── Ticket.java            # Service ticket structure
│   ├── TicketGrant.java       # TGT structure
│   ├── Dataset.csv            # User database (encrypted keys)
│   └── Log.txt                # System audit log
│
├── README.md                  # This file
├── LICENSE                    # MIT License
└── .gitignore                 # Git ignore rules

---

🎓 Academic Context

Course: BBM 465 - Information Security Laboratory
Institution: Hacettepe University, Computer Engineering Department
Semester: Fall 2024
Group: 28
Team Members:

• Mehmet Yiğit (b2210356159)
• Mehmet Oğuz Kocadere (b2210356021)

Topics Covered:

• Kerberos authentication protocol
• Ticket-based authentication systems
• Hybrid encryption (RSA + AES)
• Public Key Infrastructure (PKI)
• Session key generation and management
• Secure client-server communication
• GUI application development (JavaFX)
• Authentication security analysis

Assignment Objectives:

1. Implement Kerberos authentication protocol
2. Design hybrid encryption system
3. Create GUI-based authentication application
4. Understand SSO (Single Sign-On) concepts
5. Practice secure key management
6. Analyze enterprise authentication systems

---

🔒 Security Analysis

Strengths ✅

1. Ticket-Based Authentication

   • Passwords never transmitted over network
   • Tickets encrypted with strong encryption
   • Time-limited validity (5 minutes)

2. Hybrid Encryption

   • RSA 2048-bit for key exchange
   • AES 256-bit for data encryption
   • Industry-standard algorithms

3. Mutual Authentication

   • Both client and server verified
   • Prevents man-in-the-middle attacks
   • Trusted third party (KDC)

4. Session Keys

   • Unique key per session
   • Perfect forward secrecy
   • Limited exposure window

5. Centralized Key Management

   • KDC controls all key pairs
   • Simplified key distribution
   • Single point of trust

Limitations ⚠️

1. Time Synchronization (Educational)

   • Issue: No NTP integration
   • Impact: Ticket expiration relies on local time
   • Production Fix: Network Time Protocol (NTP)
   • Note: Outside assignment scope

2. KDC Single Point of Failure

   • Issue: If KDC down, no authentication
   • Production Fix: Replicated KDC servers
   • Example: Active Directory Domain Controllers

3. Password Storage (Educational)

   • Issue: Plaintext passwords in CSV
   • Production Fix: bcrypt/Argon2 hashing
   • Example:

   // Instead of:
   password.equals(storedPassword)
   
   // Use:
   BCrypt.checkpw(password, hashedPassword)

4. No Network Communication

   • Issue: Single-machine simulation
   • Production Fix: Network sockets, RMI, or REST API
   • Note: Demonstrates protocol logic only

5. Ticket Storage

   • Issue: In-memory ticket storage
   • Production Fix: Encrypted persistent storage
   • Example: OS credential manager, encrypted database

Production Recommendations

// 1. Password Hashing
import org.mindrot.jbcrypt.BCrypt;
String hashedPassword = BCrypt.hashpw(password, BCrypt.gensalt(12));

// 2. Time Synchronization
import java.time.Instant;
Instant.now() // Use UTC time from NTP server

// 3. Network Communication
ServerSocket serverSocket = new ServerSocket(88); // Kerberos port
Socket clientSocket = serverSocket.accept();

// 4. Persistent Storage
// Use encrypted database or key vault
import java.security.KeyStore;

// 5. Logging and Monitoring
import org.slf4j.Logger;
Logger logger = LoggerFactory.getLogger(KDC.class);

// 6. Rate Limiting
// Prevent brute force attacks
if (failedAttempts > 5) {
    Thread.sleep(30000); // 30-second delay
}

---

🎯 Learning Outcomes

By studying this project, you will understand:

1. Kerberos Protocol

• Three-party authentication model
• Ticket-based authentication flow
• Single Sign-On (SSO) implementation
• TGT vs. Service Ticket differences

2. Hybrid Encryption

• RSA for key exchange
• AES for data encryption
• Performance vs. security trade-offs
• When to use symmetric vs. asymmetric

3. Enterprise Authentication

• How Active Directory works
• Centralized authentication benefits
• Key Distribution Center role
• Session management strategies

4. Cryptographic Concepts

• Public/Private key pairs
• Session key generation
• Ticket encryption mechanisms
• Timestamp-based security

5. Java Security APIs

• javax.crypto package usage
• KeyPairGenerator implementation
• Cipher operations
• SecretKey management

6. GUI Development

• JavaFX application structure
• Event-driven programming
• User input validation
• Real-time log display

---

🤝 Contributing

Contributions welcome! Areas for improvement:

1. Add network communication (sockets/RMI)
2. Implement NTP time sync
3. Add password hashing (bcrypt)
4. Create REST API for services
5. Add ticket renewal mechanism
6. Implement KDC replication
7. Add audit logging to database
8. Create admin interface

How to Contribute

1. Fork repository
2. Create feature branch
3. Implement changes
4. Test thoroughly
5. Submit pull request

---

📄 License

MIT License - see LICENSE file

---

👤 Author

Mehmet Oğuz Kocadere

• 🎓 Computer Engineering Student @ Hacettepe University
• 🔒 Focus: Authentication Systems, PKI, Enterprise Security
• 💼 LinkedIn
• 📧 Email: canmehmetoguz@gmail.com
• 🌐 GitHub: @memo-13-byte

🔗 Related Security Projects

• Classical Cryptography Toolkit - Cipher implementation & cryptanalysis
• File Integrity Checker - RSA digital signatures & PKI
• Secure Flask Auth Portal - 2FA with hash chain OTP

---

🙏 Acknowledgments

• Hacettepe University - Computer Engineering Department
• BBM 465 Course - Information Security Laboratory
• MIT Kerberos - Original protocol design
• Microsoft Active Directory - Real-world implementation inspiration

---

📊 Statistics

---

📚 References

• Kerberos Protocol (RFC 4120)
• Java Cryptography Architecture
• JavaFX Documentation
• Microsoft Active Directory

---

⭐ Star this repository if you found it helpful!

Made with ❤️ for enterprise authentication education