{{cleanup, date=November 2011 In

cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adver ...

, a key distribution center (KDC) is part of a cryptosystem intended to reduce the risks inherent in exchanging

key Key or The Key may refer to: Common meanings * Key (cryptography), a piece of information that controls the operation of a cryptography algorithm * Key (lock), device used to control access to places or facilities restricted by a lock * Key (map ...

s. KDCs often operate in systems within which some users may have permission to use certain services at some times and not at others.

Security overview

For instance, an administrator may have established a policy that only certain users may back up to tape. Many

operating system An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs. Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...

s can control access to the tape facility via a "system service". If that system service further restricts the tape drive to operate only on behalf of users who can submit a service-granting ticket when they wish to use it, there remains only the task of distributing such tickets to the appropriately permitted users. If the ticket consists of (or includes) a key, one can then term the mechanism which distributes it a KDC. Usually, in such situations, the KDC itself also operates as a system service.

Operation

A typical operation with a KDC involves a request from a user to use some service. The KDC will use cryptographic techniques to authenticate requesting users as themselves. It will also check whether an individual user has the right to access the service requested. If the authenticated user meets all prescribed conditions, the KDC can issue a ticket permitting access. KDCs mostly operate with symmetric encryption. In most (but not all) cases the KDC shares a

with each of all the other parties. The KDC produces a

ticket Ticket or tickets may refer to: Slips of paper * Lottery ticket * Parking ticket, a ticket confirming that the parking fee was paid (and the time of the parking start) * Toll ticket, a slip of paper used to indicate where vehicles entered a tol ...

based on a

server Server may refer to: Computing *Server (computing), a computer program or a device that provides functionality for other programs or devices, called clients Role * Waiting staff, those who work at a restaurant or a bar attending customers and su ...

key. The

client Client(s) or The Client may refer to: * Client (business) * Client (computing), hardware or software that accesses a remote service on another computer * Customer or client, a recipient of goods or services in return for monetary or other valuabl ...

receives the ticket and submits it to the appropriate

. The server can verify the submitted ticket and grant access to user submitting it. Security systems using KDCs include Kerberos. (Actually, Kerberos partitions KDC functionality between two different agents: the AS (Authentication Server) and the TGS (Ticket Granting Service).)

External links

Kerberos Authentication Protocol
* Microsoft
Kerberos Key Distribution Center - TechNet
* Microsoft
Key Distribution Center - MSDN
Key management Computer network security