A distributed system needs one trusted third party that clients and servers both rely on to mediate their mutual authentication, using only secret keys it shares with each of them. Which of these is that service?

Answer

Kerberos

Options - A. Kerberos - B. X.509 - C. PCBC - D. S/MIME Why - A. Correct. Kerberos is an authentication service for a distributed environment: it is trusted in the specific sense that clients and servers trust it to mediate between them. - B. X.509 is a certificate *format* — a way of binding a public key to a name. It is a data standard, not a running service that authenticates anybody. - C. PCBC is a cipher mode of operation, and the trap is that Kerberos v4 genuinely used it. Knowing that it appears in the Kerberos story is not the same as knowing what Kerberos is. - D. S/MIME secures e-mail messages end to end. It uses certificates, but it mediates nothing between a client and a server. The four options come from four different topics, so this really asks whether you know what *kind of thing* Kerberos is. It is a service, not a format and not a mode.

Stallings & Brown, Computer Security 5e, ch23 §23.1