Key Distribution Center (KDC)

The Key Distribution Center is the trusted third party that makes Kerberos work. It holds the secret keys of every user and service in the realm and contains two logical components: the Authentication Service, which verifies logons and issues the Ticket Granting Ticket, and the Ticket Granting Service, which exchanges TGTs for service tickets. In Active Directory, every domain controller runs a KDC, and the KDC’s own long-term key is the password hash of the KRBTGT account.

Because everything trusts the KDC, everything breaks if the KDC is compromised or unavailable. It is a single point of failure for authentication, which is why it is replicated across domain controllers, and it is the crown-jewel target in the Kerberos attack chain: stealing its KRBTGT key enables the golden ticket attack.

Exam relevance: the KDC is the classic example of a trusted third party in authentication, and its weaknesses are as testable as its function. Expect questions on the KDC as a single point of failure and on Kerberos’s dependence on synchronised clocks, since the tickets the KDC issues carry timestamps to resist replay attacks.