Extensible Pre-authentication Kerberos

Kerberos is a well-established authentication system. As new authentication methods arise, incorporating them into Kerberos is desirable. However, extending Kerberos poses challenges due to a lack of source code availability for some implementations and a lengthy standardization process. This paper presents Extensible Pre-Authentication in Kerberos (EPAK), a Kerberos extension that enables many authentication methods to be loosely coupled with Ker- beros, without further modification to Kerberos. To demon- strate the utility of the framework, two authentication meth- ods for open systems are presented that have been imple- mented as Kerberos extensions using EPAK. These exten- sions illustrate the flexibility EPAK brings to Kerberos while maintaining backwards compatibility.