The paper "The Evolution of the Kerberos Authentication System" is a very
good description of the limitations of Kerberos 4 and what changes were made
in Kerberos 5. This paper is available from
<ftp://athena-dist.mit.edu/pub/kerberos/doc/krb_evol.PS>.

However, here is a quick list of the more important changes:

   * The key salt algorithm has been changed to use the entire principal
     name.
   * The network protocol has been completely redone and now uses ASN.1
     encoding everywhere.
   * There is now support for forwardable, renewable, and postdatable
     tickets.
   * Kerberos tickets can now contain multiple IP addresses and addresses
     for different types of networking protocols.
   * A generic crypto interface module is now used, so other encryption
     algorithms beside DES can be used.
   * There is now support for replay caches, so authenticators are not
     vulnerable to replay.
   * There is support for transitive cross-realm authentication.

Some parts © 2009 Advameg, Inc.