The documentation of MIT Kerberos explains here how the credential cache file is formatted. It basically consists of:
- a header
- information about the REALM and the user
- a keyblock
- information about the expiration of the ticket
- authdata
- the tickets themselves
I figured out the purpose of most of these components but still don't understand what the keyblock is for. It is some encrypted blob that is essential for authenticating with Kerberos. I've been digging through the documentation and a lot of other resources to find out about this but couldn't find a clear answer. It could be an encrypted timestamp to avoid replay attacks or maybe a checksum. But I don't know for sure.
Does anyone know what the purpose of this block is? And what kind of information it encodes?