Steve Syfuhs
- Works on the team building Windows authentication at Microsoft
- Primary developer of Kerberos.NET, now in the .NET Foundation
- Writes publicly on Windows authentication internals at syfuhs.net
Bio
Steve Syfuhs is a principal software engineer at Microsoft working on Windows authentication, and the primary developer of Kerberos.NET, a managed-code Kerberos library now in the .NET Foundation. He previously worked on adoption of Kerberos and TLS 1.3 and on credential protection technologies including Credential Guard. He writes publicly about how Windows authentication actually works.
Profile built from public employer, project, and publication records.
Where their work shows up
Kerberos and NTLM authenticate most of the working world and are documented mostly in specifications and vendor articles written for administrators rather than engineers. Public explanation of the internals, why a ticket looks the way it does, what Credential Guard actually protects, and what has to be true before NTLM can be turned off, is rare and load-bearing. See Kerberoasting, Kerberos delegation abuse, and the ITDR guide.
Related on Start with Identity
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S
- BlogKerberLoss: invisible Unicode lets an attacker twin a Kerberos SPN
CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade.
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit