Authentication Protocols Comparison: Kerberos vs TACACS+ vs RADIUS ~ Logon2Tech

Authentication protocols are methods used to verify the identity of a user, device, or system in a secure manner, ensuring that only authorized entities can access certain resources. These protocols establish trust through various techniques such as password verification, cryptographic keys, or biometric data.

Key authentication protocols include:

Password-based Authentication: The most basic method, where a user provides a secret password to gain access. It relies on the confidentiality of the password.
Multi-Factor Authentication (MFA): Combines multiple methods (e.g., something you know, something you have, something you are) for more secure authentication.
Kerberos: A network authentication protocol that uses tickets and symmetric encryption to securely authenticate users in a client-server model.
OAuth: A protocol for token-based authentication, allowing third-party services to access user data without revealing passwords. Often used for single sign-on (SSO).
SAML (Security Assertion Markup Language): An XML-based protocol used for exchanging authentication and authorization data, typically for web applications and federated identity management.
OpenID Connect: Built on OAuth 2.0, this is a protocol for authenticating users in a decentralized manner, commonly used for single sign-on systems.

These protocols help secure digital identities and prevent unauthorized access in various online services, applications, and networks.

Kerberos v5

Kerberos is nothing but a computer-network authentication protocol defined in RFC 1510 and was developed by MIT. The protocol states how clients communicate with a network authentication service. It is used as default authentication protocol in windows operating systems.

Working
Similar to NTLM, kerberos uses the domain name, user name, and password to represent the client’s identity. The Kerberos Key Distribution Center issues a ticket to the client, and a ticket is presented to the server once a connection is established. Both - the client and server computers must both be in the same domains, and those domains must possess a trust relationship.

Characteristics

Uses the entire principal name for key salting algorithm.
For encoding, it uses the ASN.1 coding system.
It provides ticket support facilities such as forwarding, renewing and postdating tickets.
It contains multiple IP addresses and other addresses for types of network protocols.
It also provides reasonable transitive cross-realm authentication support.

Vulnerability
Kerberos when implemented with a Data Encryption Standard cipher is weak in encryption and can be mitigated by making use of new ciphers like AES instead of DES. Microsoft, back in November 2014, did rectify an exploitable vulnerability in windows implementation of the KDC. The vulnerability allowed users to ‘elevate’ their privileges, up to Domain level.

Limitations

Single point of failure: It needs continuous availability of a central server and when the kerberos server is down, new users cannot log in.
The administration protocol is not standardized and differs between server implementations.
Setting own kerberos keys is required when each network service requires a different host name.
It requires user accounts, user clients and the service on the server to all have a trusted relationship.
It requires strict time requirements, which means the clocks of the involved hosts must be synchronized within configured limits.

TACACS

TACACS is an authentication protocol used for remote communication with any server housed in a UNIX network. TACACS provides a technique of determining user network control access via remote authentication server communication. The protocol uses port 49 by default. It complements the independent authentication, authorization, and accounting (AAA) architecture.

Characteristics

Authentication: Verifies the user's identity.
Authorization: Provides more detailed control over user permissions, such as the specific commands they are allowed to execute.
Accounting: Tracks user activity, such as command execution.
Encryption: TACACS+ encrypts the entire communication between the client and the server, providing a higher level of security compared to RADIUS.
Uses TCP (Transmission Control Protocol), which is more reliable but slower than UDP.

IP Suite
It uses TCP, which offers several advantages over UDP. TCP offers a connection-oriented transport, while UDP offers best-effort delivery. It is more scalable and adapts to grow, as well as congested, networks.

Packet Encryption
It encrypts the entire body of the packet but leaves a standard header. Within the header is a field that indicates whether the body is encrypted. For debugging, the body of packets should be unencrypted. During normal operation, the packet is encrypted for more secure communications.

Multiprotocol Support

AppleTalk Remote Access (ARA) protocol
NetBIOS Frame Protocol Control protocol
Novell Asynchronous Services Interface (NASI)
X.25 PAD connection

Router Management
It provides two methods to control the authorization of router commands on a pre-user or per-group basis.

Traffic
The amount of traffic generated between the client and the server differs. These examples illustrate the traffic between the client and server for TACACS when used with router management with AAA.

RADIUS Server

RADIUS is nothing but Remote Authentication Dial-In User Service, is a client-server protocol and software that enables remote authentication. The protocol was developed by Livingston Enterprises, Inc. and is an access server authentication and accounting protocol.

Characteristics

Authentication: Verifies the user's identity.
Authorization: Ensures the user has permission to access specific resources.
Accounting: Keeps track of user activity, like connection times and data usage.
Encryption: Only the password is encrypted, while the rest of the data is transmitted in clear text.
Uses UDP (User Datagram Protocol) for communication, which is faster but less reliable than TCP.

IP Suite
RADIUS is based on the User Datagram Protocol and is a client/server protocol. The below figure shows how the dial-in user and the RADIUS server communicates -

In order to run RADIUS all you need is a computer (ideally a server) with the appropriate system resources required for the chosen RADIUS server software you have chosen to use.

Hardware/Software
We just need the hardware that is required for the normal functioning of the software. Software depends on what features you need as there are a variety of RADIUS server packages that are available for installation. Some are OS dependent that they will run on only a specific OS and others will work on any OS you may need.

Application
The server can act as a proxy client to other RADIUS servers or other kinds of authentication servers. Normally, it is used by ISPs for managing authentication, authorization, and accounting for internet services such as ADSL, dial-up, and various forms of broadband.

Conclusion

In conclusion, authentication protocols are fundamental to ensuring secure access to digital systems, applications, and network resources. They play a critical role in verifying the identity of users, devices, and services, protecting sensitive data from unauthorized access, and maintaining trust within digital environments. From traditional methods like password-based authentication to advanced techniques such as multi-factor authentication (MFA), Kerberos, and OAuth, these protocols provide layered security solutions tailored to different needs.

Specialized protocols like RADIUS and TACACS+ serve specific use cases in network environments, providing centralized access control and management for users and network devices. The choice of authentication protocol depends on factors such as security requirements, scalability, and the type of resources being protected.

As cyber threats continue to evolve, the adoption of robust and multi-layered authentication mechanisms remains essential for safeguarding digital infrastructures. Staying informed about the strengths, limitations, and appropriate use cases of these protocols is crucial for building secure systems that protect both users and data.