Difference between SSL and Kerberos authentication?

Question

I am trying to understand what's the actual difference between SSL and Kerberos authentications, and why sometimes I have both SSL traffic and Kerberos. Or does Kerberos use SSL in any way?

Anyone could help? Thank you!

Answer 1

SSL uses public key cryptography:

1. You (or your browser) has a public/private keypair
2. The server has a public/private key as well
3. You generate a symmetric session key
4. You encrypt with the server's public key and send this encrypted session key to the server.
5. The server decrypts the encrypted session key with its private key.
6. You and the server begin communicating using the symmetric session key (basically because symmetric keys are faster).

Kerberos does not use public key cryptography. It uses a trusted 3rd party. Here's a sketch:

1. You both (server and client) prove your identity to a trusted 3rd party (via a secret).
2. When you want to use the server, you check and see that the server is trustworthy. Meanwhile, the server checks to see that you are trustworthy. Now, mutually assured of each others' identity. You can communicate with the server. 2