--- title: User-to-User Authentication: Down the Rabbit Hole – Part 1 description: A deep technical breakdown explains Kerberos user-to-user (U2U) authentication internals, contrasting it with standard Kerberos ticket flows. It traces how U2U... canonical: https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: User-to-User Authentication: Down the Rabbit Hole – Part 1 | daily.dev og:description: A deep technical breakdown explains Kerberos user-to-user (U2U) authentication internals, contrasting it with standard Kerberos ticket flows. It traces how U2U... og:url: https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev og:image: https://api.daily.dev/og/posts/OAUgYr3EV.png og:image:alt: User-to-User Authentication: Down the Rabbit Hole – Part 1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # User-to-User Authentication: Down the Rabbit Hole – Part 1 **[SpecterOps](https://daily.dev/sources/specterops)** · 19 min read · 0 upvotes · 0 comments ## Summary A deep technical breakdown explains Kerberos user-to-user (U2U) authentication internals, contrasting it with standard Kerberos ticket flows. It traces how U2U solves peer-to-peer authentication for accounts without an SPN by encrypting service tickets with a session key instead of a long-term key, examines the three theoretical U2U trigger scenarios from the original draft RFC, and shows via packet capture that Windows only implements the client-initiated scenario, observed concretely in RDP with Network Level Authentication. It also explains how the same U2U primitives underlie the UnPAC-the-Hash attack for recovering NT hashes after PKINIT authentication, promising further detail in a follow-up post. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Kerberos user-to-user (U2U) authentication differ from standard Kerberos service ticket issuance? In standard Kerberos, the KDC encrypts a service ticket with the target service account's long-term key, which requires the account to have a registered SPN. U2U instead encrypts the service ticket using the session key from an additional TGT supplied in the TGS-REQ's additional-tickets field with the ENC-TKT-IN-SKEY flag set, allowing authentication to accounts without an SPN, such as in peer-to-peer scenarios. _Track Kerberos internals like U2U ticket encryption as red team research evolves on daily.dev._ ### Why does RDP with Network Level Authentication (NLA) use U2U authentication instead of a standard service ticket? NLA triggers U2U because CredSSP calls InitializeSecurityContext with the ISC_REQ_USE_SESSION_KEY flag, which forces a fresh, non-cacheable session key via a U2U exchange rather than reusing a cached long-term key. This limits exposure since the resulting ticket is short-lived, tied to the TGT lifetime, and delivers the client's credentials over a newly keyed encrypted channel. _Follow deep protocol traces like this RDP CredSSP U2U flow to stay sharp on daily.dev._ ### How does the UnPAC-the-Hash attack recover a user's NT hash after PKINIT authentication? An attacker with a user's certificate performs their own PKINIT exchange to obtain a TGT and derive the AS reply key from the Diffie-Hellman exchange. They then request a U2U service ticket for themselves, decrypt it using their own TGT session key, extract the PAC, and use the AS reply key to decrypt PAC_CREDENTIAL_INFO, revealing the NT hash for pass-the-hash or Kerberos ticket requests. _Study attack chains like UnPAC-the-Hash to keep AD security tradecraft current on daily.dev._ ## Similar posts on daily.dev - [Kerberoasting Attack Explained Step by Step](https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx) · Latest Hacking News · 0 upvotes · 0 comments - [HTB: Signed](https://daily.dev/posts/htb-signed-zkhb7xhv2) · 0xdf hacks stuff · 1 upvotes · 0 comments - [Exploiting Resource-Based Constrained Delegation \(RBCD\)](https://daily.dev/posts/exploiting-resource-based-constrained-delegation-rbcd--mazebndcw) · InfoSec Write-ups · 0 upvotes · 0 comments - [Zero Trust Infrastructure for Multi-LLM Context Routing](https://daily.dev/posts/zero-trust-infrastructure-for-multi-llm-context-routing-3ktwah34g) · Security Boulevard · 0 upvotes · 0 comments - [Google Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://daily.dev/posts/google-authenticator-the-hidden-mechanisms-of-passwordless-authentication-8djcluo5b) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#active-directory](https://daily.dev/tags/active-directory), [#red-teaming](https://daily.dev/tags/red-teaming), [#kerberos](https://daily.dev/tags/kerberos) [View this post on daily.dev](https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"User-to-User Authentication: Down the Rabbit Hole – Part 1","url":"https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev"},"datePublished":"2026-08-23T12:16:30.715Z","dateModified":"2026-08-23T12:17:14.268Z","description":"A deep technical breakdown explains Kerberos user-to-user (U2U) authentication internals, contrasting it with standard Kerberos ticket flows. It traces how U2U...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,active-directory,red-teaming,kerberos","timeRequired":"PT19M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"User-to-User Authentication: Down the Rabbit Hole – Part 1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/user-to-user-authentication-down-the-rabbit-hole-part-1-oaugyr3ev#faq","mainEntity":[{"@type":"Question","name":"How does Kerberos user-to-user (U2U) authentication differ from standard Kerberos service ticket issuance?","acceptedAnswer":{"@type":"Answer","text":"In standard Kerberos, the KDC encrypts a service ticket with the target service account's long-term key, which requires the account to have a registered SPN. U2U instead encrypts the service ticket using the session key from an additional TGT supplied in the TGS-REQ's additional-tickets field with the ENC-TKT-IN-SKEY flag set, allowing authentication to accounts without an SPN, such as in peer-to-peer scenarios. Track Kerberos internals like U2U ticket encryption as red team research evolves on daily.dev."}},{"@type":"Question","name":"Why does RDP with Network Level Authentication (NLA) use U2U authentication instead of a standard service ticket?","acceptedAnswer":{"@type":"Answer","text":"NLA triggers U2U because CredSSP calls InitializeSecurityContext with the ISC_REQ_USE_SESSION_KEY flag, which forces a fresh, non-cacheable session key via a U2U exchange rather than reusing a cached long-term key. This limits exposure since the resulting ticket is short-lived, tied to the TGT lifetime, and delivers the client's credentials over a newly keyed encrypted channel. Follow deep protocol traces like this RDP CredSSP U2U flow to stay sharp on daily.dev."}},{"@type":"Question","name":"How does the UnPAC-the-Hash attack recover a user's NT hash after PKINIT authentication?","acceptedAnswer":{"@type":"Answer","text":"An attacker with a user's certificate performs their own PKINIT exchange to obtain a TGT and derive the AS reply key from the Diffie-Hellman exchange. They then request a U2U service ticket for themselves, decrypt it using their own TGT session key, extract the PAC, and use the AS reply key to decrypt PAC_CREDENTIAL_INFO, revealing the NT hash for pass-the-hash or Kerberos ticket requests. Study attack chains like UnPAC-the-Hash to keep AD security tradecraft current on daily.dev."}}]} ```