Clifford Neuman
- One of the principal designers of Kerberos versions 1 through 4 at MIT Project Athena
- Led the design of Kerberos version 5 with John Kohl
- Lead author of RFC 4120, the Kerberos V5 specification
Bio
Clifford Neuman was one of the principal designers of Kerberos versions 1 through 4 at MIT's Project Athena, led the version 5 design with John Kohl, and is lead author of RFC 4120, the Kerberos V5 specification. He is at the USC Information Sciences Institute.
Profile built from public IETF and academic records.
Where their work shows up
Kerberos is the authentication protocol inside Active Directory, which means it authenticates a very large share of the working world every morning. Its ticket-granting design, authenticate once, then present short-lived tickets for each service, is the same shape as every token-based system that followed, including OAuth. It is also why an attack on ticket handling is an attack on everything. See Kerberoasting, Kerberos delegation abuse, and the best ITDR for Active Directory ranking.
Related on Start with Identity
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- CVEResetNightmare, kpasswd bypasses PAC_REQUESTOR_SID
Kerberos Change Password (kpasswd) did not honor PAC_REQUESTOR_SID the way the rest of AD did. A low-privilege user who can write their UPN can reset a Domain A
- ExpertCo-author of the Needham-Schroeder protocol
Michael D. Schroeder co-authored two of the foundational papers in this field within three years of each other: the 1975 design-principles paper with Jerome Sal