Microsoft joins MIT Kerberos Consortium

Published 8 April 2008

Kerberos develops the widely used network authentication standard; eight years ago Microsoft was accused of subverting the standard by adding proprietary extensions; after Microsoft lost both U.S. and European anti-trust trials, company joins consortium

If you cannot beat ‘em, join ‘em. Microsoft has joined the MIT Kerberos
, an organization that develops
the widely used network authentication standard. It joins Apple, Google, and
Sun on the consortium’s executive board. Kerberos, which ships with most
operating systems, is a suite of authentication protocols that can enable
features such as single sign-on, where a single login and password can be used
to access multiple Web sites or applications. It was developed as part of
Massachusetts Institute of Technology’s Project Athena in the 1980s. Microsoft
has implemented Kerberos protocols in its Windows 2000, XP, Server 2003 and
2008, and Vista operating systems, but the vendor was accused eight years ago of
subverting the standard by adding proprietary extensions. During Microsoft’s U.S. antitrust trial, an
MIT professor testified the vendor had extended the Kerberos specification used
by its Windows 2000 OS such that a non-Microsoft server could not use the security
features of the PC’s OS. That evidence contributed to the view that Microsoft
gave lip service to the importance of interoperability, but implemented
technical blocks that locked out competitors. Microsoft eventually released
details on its modifications to Kerberos. After both U.S. and European
antitrust trials, Microsoft forcibly and voluntarily took steps to improve its
documentation of protocols as well as open up more of its internal technical

Microsoft’s participation in the Kerberos Consortium “shows
Microsoft’s continued and growing desire as of late to work with the
open-source community and industry consortiums around interoperability,” wrote Tom Kemp, CEO of Centrify, on his blog.
Centrify, a Microsoft partner, makes software called DirectControl that lets
servers, workstations, and devices from other vendors use Active Directory,
which is Microsoft’s authentication and provisioning technology. Authentication
is accomplished using Kerberos, Kemp wrote. Despite embroiling itself in
controversy, Microsoft’s involvement with Kerberos has also made use of the
protocol more widespread, Kemp wrote. “As we all know there are many out
there that like to beat up Microsoft regarding security, but it is ironic that
Microsoft by default delivers the added security of Kerberos as part and parcel
of the Windows platform,” Kemp wrote.