Editing Kerberos (protocol) (section)

====Client Authentication====
# The client sends a [[plaintext]] message of the user ID to the AS (Authentication Server) requesting services on behalf of the user. (Note: Neither the secret key nor the password is sent to the AS.)
# The AS checks to see whether the client is in its database. If it is, the AS generates the secret key by hashing the password of the user found at the database (e.g., [[Active Directory]] in Windows Server) and sends back the following two messages to the client:
#* Message A: ''Client/TGS Session Key'' encrypted using the secret key of the client/user.
#* Message B: ''Ticket-Granting-Ticket'' (TGT, which includes the client ID, client [[network address]], ticket validity period, and the ''Client/TGS Session Key'') encrypted using the secret key of the TGS.
# Once the client receives messages A and B, it attempts to decrypt message A with the secret key generated from the password entered by the user.  If the user entered password does not match the password in the AS database, the client's secret key will be different and thus unable to decrypt message A.  With a valid password and secret key the client decrypts message A to obtain the ''Client/TGS Session Key''. This session key is used for further communications with the TGS. (Note: The client cannot decrypt Message B, as it is encrypted using TGS's secret key.)  At this point, the client has enough information to authenticate itself to the TGS.