Which of the following uses a Key Distribution Center (KDC) to authenticate a principle?

Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications using secret-key cryptography. Its architecture is fundamentally based on a trusted third-party service known as the Key Distribution Center (KDC). The KDC authenticates a principal (e.g., a user or a service) and provides it with a ticket-granting ticket (TGT). This TGT is then used to request service tickets for specific resources on the network, enabling secure, single sign-on capabilities without repeatedly exposing the principal's long-term secret key over the network.

A. CHAP: Challenge-Handshake Authentication Protocol (CHAP) uses a three-way handshake with a shared secret to periodically verify the identity of a peer. It does not use a KDC.

B. PAP: Password Authentication Protocol (PAP) is a simple protocol that transmits the username and password in cleartext over the network. It lacks a KDC and is highly insecure.

D. TACACS: Terminal Access Controller Access-Control System (TACACS/TACACS+) is a centralized AAA (Authentication, Authorization, and Accounting) protocol. It uses a central server but not a KDC for issuing tickets.

1. Neuman

B. C.

& Ts'o

T. (1994). Kerberos: An Authentication Service for Computer Networks. IEEE Communications Magazine

32(9)

33-38. DOI: https://doi.org/10.1109/35.312841. (This foundational paper describes the Kerberos architecture

explicitly detailing the role of the KDC in authenticating principals on page 34

Section III.A).

2. Kohl

J.

& Neuman

C. (1993). RFC 1510: The Kerberos Network Authentication Service (V5). Internet Engineering Task Force. (This has been obsoleted by RFC 4120

but the core concept remains). RFC 4120

Section 1.2

"Tickets

" states: "The Kerberos protocol is based on the Needham-Schroeder... model. The Kerberos server is known as the Key Distribution Center (KDC)."

3. MIT OpenCourseWare. (2017). 6.857 Computer and Network Security

Lecture 10: Kerberos. Massachusetts Institute of Technology. Available at: https://ocw.mit.edu/courses/6-857-computer-and-network-security-fall-2017/resources/mit6857f17lec10/. (The lecture notes

specifically slides 5-7

detail the Kerberos architecture

showing the KDC as the central authenticator).

4. Simpson

W. (1996). RFC 1994: PPP Challenge Handshake Authentication Protocol (CHAP). Internet Engineering Task Force. Section 2

"Operation

" describes the three-way handshake mechanism

which does not involve a KDC.