Which of the following uses a Key Distribution Center (KDC) to authenticate a principle?

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. Its architecture is fundamentally based on a trusted third-party service known as the Key Distribution Center (KDC). The KDC authenticates a principal (e.g., a user or a service) and provides it with a ticket-granting ticket (TGT). This TGT is then used to request service tickets for specific resources on the network, enabling secure, single sign-on capabilities without repeatedly exposing the principal's long-term secret key over the network.

A. CHAP: Challenge-Handshake Authentication Protocol (CHAP) uses a three-way handshake with a shared secret to periodically verify the identity of a peer. It does not use a KDC.
B. PAP: Password Authentication Protocol (PAP) is a simple protocol that transmits the username and password in cleartext over the network. It lacks a KDC and is highly insecure.
D. TACACS: Terminal Access Controller Access-Control System (TACACS/TACACS+) is a centralized AAA (Authentication, Authorization, and Accounting) protocol. It uses a central server but not a KDC for issuing tickets.

1. Neuman, B. C., & Ts'o, T. (1994). Kerberos: An Authentication Service for Computer Networks. IEEE Communications Magazine, 32(9), 33-38. DOI: https://doi.org/10.1109/35.312841. (This foundational paper describes the Kerberos architecture, explicitly detailing the role of the KDC in authenticating principals on page 34, Section III.A).

2. Kohl, J., & Neuman, C. (1993). RFC 1510: The Kerberos Network Authentication Service (V5). Internet Engineering Task Force. (This has been obsoleted by RFC 4120, but the core concept remains). RFC 4120, Section 1.2, "Tickets," states: "The Kerberos protocol is based on the Needham-Schroeder... model. The Kerberos server is known as the Key Distribution Center (KDC)."

3. MIT OpenCourseWare. (2017). 6.857 Computer and Network Security, Lecture 10: Kerberos. Massachusetts Institute of Technology. Available at: https://ocw.mit.edu/courses/6-857-computer-and-network-security-fall-2017/resources/mit6857f17lec10/. (The lecture notes, specifically slides 5-7, detail the Kerberos architecture, showing the KDC as the central authenticator).

4. Simpson, W. (1996). RFC 1994: PPP Challenge Handshake Authentication Protocol (CHAP). Internet Engineering Task Force. Section 2, "Operation," describes the three-way handshake mechanism, which does not involve a KDC.