Kerberos Pre-Authentication in Windows 2000

Kerberos pre-authentication in Microsoft Windows 2000 is a security mechanism designed to prevent offline password cracking attacks by forcing users to prove their identity before the server returns an encrypted credential. In standard Kerberos exchanges, an attacker could request a ticket for any user and attempt to brute-force the password hash offline; Windows 2000 mitigates this vulnerability by requiring the client to supply an encrypted timestamp in the initial authentication request, ensuring that the Key Distribution Center (KDC) only responds with encrypted ticket data to legitimate users.

The Vulnerability in Standard Kerberos

In basic Kerberos v5 implementations without pre-authentication, the authentication process begins with an Authentication Service Request (KRB_AS_REQ) sent from the client to the KDC. The client requests a Ticket Granting Ticket (TGT) by simply naming the user account.

Because the baseline protocol does not require proof of knowledge of the secret key at this initial stage, the KDC immediately responds with an Authentication Service Reply (KRB_AS_REP). This reply includes the TGT and a session key, part of which is encrypted using a secret symmetric key derived from the user's plaintext password.

Without pre-authentication, an attacker on the network can generate a KRB_AS_REQ for any domain account without providing credentials. The KDC sends back the KRB_AS_REP, providing the attacker with encrypted ciphertext that can be captured and subjected to an offline dictionary or brute-force attack without generating failed logon events on the domain controller.

The Windows 2000 Pre-Authentication Mechanism

Windows 2000 Active Directory resolves this vulnerability by enabling pre-authentication by default through the Kerberos extension defined in RFC 1510, specifically utilizing the encrypted timestamp method (PA-ENC-TIMESTAMP).

The execution follows a strict sequence:

  1. Initial Request: The Windows 2000 client sends a standard KRB_AS_REQ to the KDC (the Active Directory Domain Controller) requesting a TGT for a specific user principal name (UPN).
  2. KDC Challenge: Because pre-authentication is enforced on the account, the KDC intercepts the request, notes the absence of pre-authentication data, and rejects the request by returning a Kerberos error: KRB_ERROR with error code KDC_ERR_PREAUTH_REQUIRED (error code 25). This message informs the client of the accepted pre-authentication types.
  3. Key Derivation and Encryption: The client software derives an encryption key from the user's password using the configured hashing and derivation algorithms (primarily DES-CBC-MD5 or DES-CBC-CRC in Windows 2000, along with RC4-HMAC/NTLM keys). The client then records the current system timestamp and encrypts it using this derived key.
  4. Second Request: The client issues a second KRB_AS_REQ, appending the encrypted timestamp within the padata (pre-authentication data) field of type PA-ENC-TIMESTAMP (data type 2).
  5. KDC Verification: The KDC receives the request, locates the user's account in Active Directory, retrieves the matching password-derived secret key, and attempts to decrypt the timestamp.
  6. Clock Skew and Replay Check: Once decrypted, the KDC verifies that the decrypted timestamp matches its own system clock within an acceptable skew window (configured to a default maximum of 5 minutes). The KDC also checks its replay cache to ensure that the exact timestamp has not been used previously, guarding against replay attacks.
  7. Ticket Issuance: If the timestamp decrypts successfully and falls within the allowed time delta, the KDC confirms that the requester possesses the user's true credentials. The KDC then issues the standard KRB_AS_REP containing the TGT and the encrypted session key. If the decryption fails or the timestamp is outside the allowable range, the KDC drops or denies the request with an authentication failure.

Security Impact

By enforcing pre-authentication, Windows 2000 prevents attackers from obtaining encrypted AS-REP packets for accounts whose passwords they do not already know. An attacker cannot induce the domain controller to emit ciphertext for offline analysis, effectively neutralizing offline password guessing against the Kerberos Authentication Service.