Key Distribution

1. The Core Problem (Symmetric Keys Don't Travel Alone)

$n$ users need pairwise symmetric keys: $\frac{n(n-1)}{2}$ keys ( $1000$ users → $\approx 500{,}000$ ) — unmanageable by hand. Requirements: keys delivered securely (no eavesdrop), timely (session keys per conversation), with authentication (right peer, not MITM), and revocation/refresh. Solutions: physical/courier (ancient), KDC (central trusted server), public-key distribution (Module 5), Diffie–Hellman (no prior shared secret).

2. KDC Protocol (Needham–Schroeder Symmetric Core)

Trusted Key Distribution Center shares long-term master key $K_X$ with each party $X$ . A requests session key for B:

1. A → KDC: (A, B, N_A)                       [N_A = A's nonce]
2. KDC → A: E(K_A, [K_s, B, N_A, E(K_B, [K_s, A])])
   A decrypts, checks N_A ✓, keeps K_s; forwards ticket to B
3. A → B: E(K_B, [K_s, A])                     [ticket, B decrypts]
4. B → A: E(K_s, N_B)                          [B proves K_s, challenges]
5. A → B: E(K_s, f(N_B))                       [A proves K_s; f = N_B-1/+1]

Steps 4–5 = mutual authentication (both prove live possession of $K_s$ ); nonces kill replays. Kerberos (MIT/Athena) is this idea industrialized: Authentication Server + Ticket-Granting Server, tickets with lifetimes, synchronized clocks instead of nonces-per-step.

3. Key Lifetimes and Hierarchy (Exam Table)

Key type	Lifetime	Scope	If compromised
Master / key-encrypting ( $K_A$ )	Months–years	KDC↔user channel	Reissue for that user; sessions stay safe (forward secrecy lacks only if logged)
Session key ( $K_s$ )	Minutes–hours, one conversation	Single A↔B session	Only that session leaks — hence short life
Ticket (TGT/service)	Hours (Kerberos ~10 h)	Service access without re-login	Replayable till expiry — hence lifetimes + authenticators

Hierarchy rule: masters protect session distribution; sessions protect data; data keys rotate fastest. Compromise blast radius shrinks downward — design exams around this sentence.

4. Beyond KDC: Public-Key and Modern Practice

Public-key distribution: CA-signed certificates bind $PK_B$ to B (Module 5–6); A encrypts $K_s$ under $PK_B$ — no online KDC, but PKI trust needed.
Diffie–Hellman: agree $K_s$ over open channel (authenticated DH against MITM) — TLS 1.3's (EC)DHE-only design.
KDC weaknesses: single point of failure/attack, bottleneck ( $O(n)$ masters but central load), no native inter-realm without chaining (Kerberos cross-realm), clock-sync dependence.
Modern rule: ephemeral (EC)DHE session keys + signatures/certs for authentication + KDF expansion — KDC/Kerberos survives inside enterprises (Windows AD), PKI+DH on the open Internet.

Exam Points

5-step KDC message flow with nonce/ticket roles — 5-mark diagram core.
Steps 4–5 mutual-auth + replay logic — favourite 2–3 marker.
Key-hierarchy table + "blast radius shrinks downward" line.
KDC vs public-key/DH comparison + Kerberos one-liner.

Key Distribution