If you're new to Kerberos, I would suggest you read:

   * Bill Bryant, "Designing an Authentication System: A Dialogue in Four
     Scenes."
     <http://web.mit.edu/kerberos/www/dialogue.html>

     A cute explanation of Kerberos protocol, in plain English. Technobabble
     is kept to a minimum.

   * Jeffrey I. Schiller, "Secure Distributed Computing", Scientific
     American, November 1994, pp 72-76.

     An excellent overview that covers all of the important details of the
     Kerberos protocol. It also explains how it's used at MIT as a "real
     world" example. This article could be useful in persuading manager
     droids that Kerberos is a good thing.

   * J. G. Steiner, B. Clifford Neuman, and J.I. Schiller, "Kerberos: An
     Authentication Service for Open Network Systems".
     <ftp://athena-dist.mit.edu/pub/kerberos/doc/usenix.PS>

     The original paper describing Kerberos. A good general overview. It
     describes the encryption notation used by many other Kerberos papers,
     so it is definitely worth reading if you want to read other Kerberos
     papers.

   * Brian Tung, "The Moron's Guide to Kerberos"
     <http://www.isi.edu/~brian/security/kerberos.html>

     Despite the title, goes into a fair amount of detail. I would suggest
     reading this after you have read one or more of the higher-level
     papers.

The MIT Kerberos web page <http://web.mit.edu/kerberos/www/> has many links
pointing to Kerberos resources.

One of the best tutorials for Kerberos is Jim Rowe's, "How To Kerberize Your
Site", which is available at:

   * <http://www.y12.doe.gov/~jar/HowToKerb.html>

There is an RFC for Kerberos 5: RFC 1510, which is available at:

<http://www.ietf.org/rfc/rfc1510.txt>

But it is a rather difficult read unless you already know a lot about how
Kerberos works.

Some parts © 2009 Advameg, Inc.